@sideboard-ai/core 0.1.68 → 0.1.71

package/dist/index.js

@@ -4,7 +4,7 @@ import {
   listWorkspaces,
   removeWorkspace,
   syncWorkspacesFromThreads
-} from "./chunk-DPDGMMGI.js";
+} from "./chunk-3CY6WJ7O.js";
 import {
   BRIGHTSY_MCP_ALLOWED_TOOLS,
   CLAUDE_MODEL_CATALOG,
@@ -58,7 +58,7 @@ import {
   sideboardMcpProfile,
   threadRequestsBrightsyMcp,
   writeInjectedMcpConfig
-} from "./chunk-6Q7H6SMX.js";
+} from "./chunk-S25IHL5H.js";
 import {
   CLOUD_COORDINATOR_BUSY_REPLY,
   CLOUD_COORDINATOR_STOPPED_REPLY,
@@ -71,18 +71,30 @@ import {
   coerceOrchestratorAgent,
   createGlobalChat,
   ensureCloudCoordinator,
+  ensureSlackCoordinator,
   healOrchestrationSoccerTitles,
   isCloudCoordinatorThread,
   isGlobalRepoPath,
   isGlobalThread,
   isOrchestratorCapableAgent,
   isOrchestratorThread,
+  isSlackCoordinatorThread,
   listGlobalThreads,
   orchestrationTitleNeedsSoccerNickname,
   orchestratorSessionPoisonedByBuiltins,
   parseForceStopMessage,
+  slackCoordinatorSourceRef,
   takenTeamSlugsForOrchestration
-} from "./chunk-ROXEENBT.js";
+} from "./chunk-57ROTAFD.js";
+import {
+  COORDINATOR_TOOL_PLAYBOOK,
+  SLACK_REPLY_FORMATTING,
+  coordinatorSystemPrompt,
+  coordinatorTurnReminder,
+  enrichWorkspacesWithGithub,
+  ensureGlobalCoordinatorCwd,
+  formatWorkspaceInventory
+} from "./chunk-H2IXNFQ2.js";
 import {
   brightsyConfigPath,
   brightsyMcpServerName,
@@ -117,14 +129,6 @@ import {
   pushTurnStderr,
   summarizeTurnStderr
 } from "./chunk-3WJAUKIL.js";
-import {
-  COORDINATOR_TOOL_PLAYBOOK,
-  coordinatorSystemPrompt,
-  coordinatorTurnReminder,
-  enrichWorkspacesWithGithub,
-  ensureGlobalCoordinatorCwd,
-  formatWorkspaceInventory
-} from "./chunk-VX6ACNXS.js";
 import {
   HARNESS_ENV_KEYS,
   appSettingsPath,
@@ -138,10 +142,13 @@ import {
   brightsyInjectWorktreeMcpEnabled,
   caffeinateWhileCloudConnectEnabled,
   caffeinateWhileRunningEnabled,
+  caffeinateWhileSlackListenEnabled,
   childEnvWithAppSettings,
   claudeChromeEnabled,
   claudeUserSettingsPath,
   deleteBranchOnPurgeEnabled,
+  disconnectLinearConnection,
+  ensureSlackDeviceIdentity,
   getDefaultAgent,
   getDefaultEffort,
   getDefaultFast,
@@ -150,16 +157,27 @@ import {
   getLinearApiKey,
   harnessEnvKey,
   isLinearConnected,
+  isSecureFileEncrypted,
   loadAppSettings,
   maxConcurrentAgents,
   orchestrationQuotaFallbackAgent,
   orchestrationQuotaOnLimit,
+  persistVaultKeyInKeychain,
+  readKeychainVaultKey,
+  readSecureJson,
   resolveAgentExecutable,
   resolveClaudeExecutable,
   resolveEffectiveIssueSource,
   resolveNewThreadOptions,
   resolveThreadDefaults,
+  resolveVaultKey,
   saveAppSettings,
+  saveLinearOAuth,
+  secureFileUnlocksWith,
+  setVaultMasterKey,
+  slackAppLevelToken,
+  slackListenEnabled,
+  toPublicAppSettings,
   updateAdvancedSettings,
   updateAgentExecutable,
   updateAppEnvironment,
@@ -168,8 +186,17 @@ import {
   updateCodexSettings,
   updateDefaultsSettings,
   updateIntegrationsSettings,
-  updateOpencodeSettings
-} from "./chunk-MHR4OGZ4.js";
+  updateOpencodeSettings,
+  writeSecureJson
+} from "./chunk-W7YOTDVO.js";
+import {
+  caffeinateHoldPath,
+  getCaffeinateHold,
+  setCaffeinateHold
+} from "./chunk-JAWEDVVA.js";
+import {
+  writePrivateFile
+} from "./chunk-JT7R45JB.js";
 import {
   FAMOUS_SOCCER_TEAMS,
   addPrStackLayer,
@@ -232,7 +259,7 @@ import {
   worktreeDisplayLabel,
   worktreeDisplayLabelForGroup,
   worktreeNameFromPath
-} from "./chunk-EEBDVLDK.js";
+} from "./chunk-MF2YMEGD.js";
 import {
   ATTACHMENTS_DIR,
   LEGACY_ATTACHMENTS_DIR,
@@ -322,9 +349,9 @@ async function getGitHubStatus() {
     };
   }
   const status = await run("gh", ["auth", "status"], { reject: false });
-  const text = `${status.stdout}
+  const text2 = `${status.stdout}
 ${status.stderr}`;
-  const loginMatch = text.match(/Logged in to ([^\s]+) account (\S+)/i) ?? text.match(/Logged in to ([^\s]+) as (\S+)/i);
+  const loginMatch = text2.match(/Logged in to ([^\s]+) account (\S+)/i) ?? text2.match(/Logged in to ([^\s]+) as (\S+)/i);
   if (loginMatch) {
     return {
       connected: true,
@@ -344,8 +371,255 @@ async function refreshGitHubAuth() {
   return getGitHubStatus();
 }
 
-// src/integrations/linear.ts
+// src/integrations/linear-oauth.ts
+import { createHash, randomBytes } from "crypto";
+import { createServer } from "http";
+
+// src/integrations/linear-app.ts
+var BAKED_LINEAR_CLIENT_ID = "39a15abc7ea5bea17c47f47f85ff5fd0";
+var BAKED_LINEAR_CLIENT_SECRET = "";
+function hasBakedLinearOAuth() {
+  return Boolean(BAKED_LINEAR_CLIENT_ID.trim());
+}
+
+// src/integrations/linear-oauth.ts
+var LINEAR_OAUTH_PORT = 19848;
+var LINEAR_OAUTH_REDIRECT = `http://127.0.0.1:${LINEAR_OAUTH_PORT}/callback`;
+var LINEAR_AUTHORIZE = "https://linear.app/oauth/authorize";
+var LINEAR_TOKEN = "https://api.linear.app/oauth/token";
+var LINEAR_REVOKE = "https://api.linear.app/oauth/revoke";
 var LINEAR_GRAPHQL = "https://api.linear.app/graphql";
+var LINEAR_OAUTH_SCOPES = "read";
+var REFRESH_SKEW_MS = 5 * 6e4;
+function linearOAuthCredentials() {
+  const settings = loadAppSettings();
+  const clientId = process.env.SIDEBOARD_LINEAR_CLIENT_ID?.trim() || settings.integrations.linearClientId?.trim() || BAKED_LINEAR_CLIENT_ID.trim();
+  const clientSecret = process.env.SIDEBOARD_LINEAR_CLIENT_SECRET?.trim() || settings.integrations.linearClientSecret?.trim() || BAKED_LINEAR_CLIENT_SECRET.trim();
+  if (!clientId) {
+    throw new Error(
+      `Linear browser sign-in needs a Linear OAuth app Client ID. Create one at linear.app/settings/api/applications/new with callback ${LINEAR_OAUTH_REDIRECT}, then set SIDEBOARD_LINEAR_CLIENT_ID (PKCE does not require a secret). You can still paste a personal API key.`
+    );
+  }
+  return { clientId, clientSecret };
+}
+function createLinearPkce() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function linearOAuthAuthorizeUrl(clientId, state, codeChallenge) {
+  const params = new URLSearchParams({
+    client_id: clientId,
+    redirect_uri: LINEAR_OAUTH_REDIRECT,
+    response_type: "code",
+    scope: LINEAR_OAUTH_SCOPES,
+    state,
+    prompt: "consent",
+    actor: "user",
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256"
+  });
+  return `${LINEAR_AUTHORIZE}?${params.toString()}`;
+}
+function linearAuthorizationHeader(token) {
+  const t = token.trim();
+  if (!t) return t;
+  if (/^bearer\s+/i.test(t)) return t;
+  if (t.startsWith("lin_api_")) return t;
+  return `Bearer ${t}`;
+}
+function htmlPage(title, body) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
+h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
+}
+async function exchangeLinearToken(body) {
+  const res = await fetch(LINEAR_TOKEN, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || data.error || !data.access_token?.trim()) {
+    const detail = data.error_description || data.error || `HTTP ${res.status}`;
+    throw new Error(`Linear OAuth token exchange failed: ${detail}`);
+  }
+  return data;
+}
+async function persistLinearTokens(data, viewer) {
+  return saveLinearOAuth({
+    accessToken: data.access_token.trim(),
+    refreshToken: data.refresh_token?.trim(),
+    expiresIn: data.expires_in,
+    viewerName: viewer?.name,
+    organizationName: viewer?.organizationName
+  });
+}
+async function fetchLinearViewer(accessToken) {
+  const res = await fetch(LINEAR_GRAPHQL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearAuthorizationHeader(accessToken)
+    },
+    body: JSON.stringify({
+      query: "{ viewer { name organization { name } } }"
+    })
+  });
+  if (!res.ok) return {};
+  const json = await res.json().catch(() => ({}));
+  const viewer = json.data?.viewer;
+  return {
+    name: viewer?.name?.trim() || void 0,
+    organizationName: viewer?.organization?.name?.trim() || void 0
+  };
+}
+var refreshInFlight = null;
+async function refreshLinearAccessToken(refreshToken) {
+  const { clientId, clientSecret } = linearOAuthCredentials();
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: clientId
+  });
+  if (clientSecret) body.set("client_secret", clientSecret);
+  try {
+    const data = await exchangeLinearToken(body);
+    await persistLinearTokens(data);
+    return data.access_token.trim();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/invalid_grant|invalid_token|unauthorized/i.test(message)) {
+      disconnectLinearConnection();
+      throw new Error("Linear sign-in expired \u2014 connect again in Account settings");
+    }
+    throw err;
+  }
+}
+async function getLinearAuthToken(settings = loadAppSettings()) {
+  const access = settings.integrations.linearAccessToken?.trim() || "";
+  const refresh = settings.integrations.linearRefreshToken?.trim() || "";
+  const expiresAt = settings.integrations.linearTokenExpiresAt ?? 0;
+  const apiKey = settings.integrations.linearApiKey?.trim() || "";
+  if (access && (!refresh || Date.now() < expiresAt - REFRESH_SKEW_MS)) {
+    return access;
+  }
+  if (refresh) {
+    if (!refreshInFlight) {
+      refreshInFlight = refreshLinearAccessToken(refresh).finally(() => {
+        refreshInFlight = null;
+      });
+    }
+    return refreshInFlight.catch((err) => {
+      if (apiKey) return apiKey;
+      throw err;
+    });
+  }
+  return apiKey || null;
+}
+async function startLinearOAuth(opts) {
+  const { clientId, clientSecret } = linearOAuthCredentials();
+  const state = randomBytes(16).toString("hex");
+  const pkce = createLinearPkce();
+  const authorizeUrl = linearOAuthAuthorizeUrl(clientId, state, pkce.challenge);
+  const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
+  const code = await new Promise((resolve, reject) => {
+    const server = createServer((req, res) => {
+      try {
+        const url = new URL(req.url || "/", `http://127.0.0.1:${LINEAR_OAUTH_PORT}`);
+        if (url.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end("Not found");
+          return;
+        }
+        const err = url.searchParams.get("error");
+        const gotState = url.searchParams.get("state");
+        const gotCode = url.searchParams.get("code");
+        if (err) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("Linear", `<h1>Authorization cancelled</h1><p>${err}</p>`));
+          cleanup();
+          reject(new Error(`Linear OAuth: ${err}`));
+          return;
+        }
+        if (gotState !== state || !gotCode) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("Linear", "<h1>Invalid callback</h1><p>State or code missing.</p>"));
+          cleanup();
+          reject(new Error("Linear OAuth callback was invalid"));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(
+          htmlPage(
+            "Linear connected",
+            "<h1>Linear connected</h1><p>You can close this tab and return to Sideboard.</p>"
+          )
+        );
+        cleanup();
+        resolve(gotCode);
+      } catch (e) {
+        cleanup();
+        reject(e instanceof Error ? e : new Error(String(e)));
+      }
+    });
+    const timer = setTimeout(() => {
+      cleanup();
+      reject(new Error("Linear sign-in timed out \u2014 try again"));
+    }, timeoutMs);
+    const cleanup = () => {
+      clearTimeout(timer);
+      server.close();
+    };
+    server.on("error", (e) => {
+      cleanup();
+      reject(
+        e instanceof Error && e.code === "EADDRINUSE" ? new Error(
+          `Port ${LINEAR_OAUTH_PORT} is in use. Close whatever is bound there, or paste a Linear API key instead.`
+        ) : e
+      );
+    });
+    server.listen(LINEAR_OAUTH_PORT, "127.0.0.1", () => {
+      void Promise.resolve(opts?.openUrl?.(authorizeUrl)).catch((e) => {
+        cleanup();
+        reject(e instanceof Error ? e : new Error(String(e)));
+      });
+    });
+  });
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: LINEAR_OAUTH_REDIRECT,
+    client_id: clientId,
+    code_verifier: pkce.verifier
+  });
+  if (clientSecret) body.set("client_secret", clientSecret);
+  const data = await exchangeLinearToken(body);
+  const viewer = await fetchLinearViewer(data.access_token.trim()).catch(() => ({}));
+  return persistLinearTokens(data, viewer);
+}
+async function revokeLinearToken(token, tokenTypeHint) {
+  const body = new URLSearchParams({
+    token,
+    token_type_hint: tokenTypeHint
+  });
+  await fetch(LINEAR_REVOKE, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  }).catch(() => void 0);
+}
+async function disconnectLinear() {
+  const settings = loadAppSettings();
+  const access = settings.integrations.linearAccessToken?.trim();
+  const refresh = settings.integrations.linearRefreshToken?.trim();
+  if (access) await revokeLinearToken(access, "access_token");
+  if (refresh) await revokeLinearToken(refresh, "refresh_token");
+  return disconnectLinearConnection();
+}
+
+// src/integrations/linear.ts
+var LINEAR_GRAPHQL2 = "https://api.linear.app/graphql";
 var ASSIGNED_ISSUES_QUERY = `
 query SideboardAssignedIssues($first: Int!) {
   viewer {
@@ -366,16 +640,16 @@ query SideboardAssignedIssues($first: Int!) {
 }
 `;
 async function listLinearIssuesDirect(opts) {
-  const apiKey = (opts?.apiKey ?? getLinearApiKey())?.trim();
+  const apiKey = (opts?.apiKey ?? await getLinearAuthToken())?.trim();
   if (!apiKey) {
-    throw new Error("Linear is not connected \u2014 add an API key in Account settings");
+    throw new Error("Linear is not connected \u2014 sign in from Account settings");
   }
   const first = Math.max(1, Math.min(100, opts?.limit ?? 50));
-  const res = await fetch(LINEAR_GRAPHQL, {
+  const res = await fetch(LINEAR_GRAPHQL2, {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      Authorization: apiKey
+      Authorization: linearAuthorizationHeader(apiKey)
     },
     body: JSON.stringify({
       query: ASSIGNED_ISSUES_QUERY,
@@ -545,9 +819,9 @@ function toolFilePath(input) {
   if (!input) return void 0;
   return str(input.file_path) ?? str(input.path) ?? str(input.filePath) ?? str(input.filename);
 }
-function countLines(text) {
-  if (!text) return 0;
-  return text.split("\n").length;
+function countLines(text2) {
+  if (!text2) return 0;
+  return text2.split("\n").length;
 }
 function diffFromInput(input) {
   if (!input) return {};
@@ -674,9 +948,9 @@ function applyAgentEvent(parts, event) {
 function partsToAssistantText(parts) {
   return parts.filter((p) => p.type === "text").map((p) => p.text).join("").trim();
 }
-function stripBrightsyNdjsonNoise(text) {
-  if (!text || !text.includes('"type"')) return text;
-  let out = text;
+function stripBrightsyNdjsonNoise(text2) {
+  if (!text2 || !text2.includes('"type"')) return text2;
+  let out = text2;
   out = out.replace(
     /\{"type":"(?:tool_use|tool_result|tool|thinking|usage|done|error)"[\s\S]*?\}\s*(?=\{"type":"|$|(?=[A-Za-z*#]))/g,
     ""
@@ -724,9 +998,9 @@ async function spawnAgentTurn(thread, input, onEvent) {
       `Cannot spawn ${thread.agent}: thread ${thread.id} has no worktreePath`
     );
   }
-  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-7P5NG3JZ.js");
+  const { isGlobalThread: isGlobalThread2 } = await import("./global-workspace-SVRYNJZA.js");
   if (isGlobalThread2(thread)) {
-    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-HD6IMCKS.js");
+    const { ensureGlobalCoordinatorCwd: ensureGlobalCoordinatorCwd2 } = await import("./coordinator-prompt-QYYG2IBB.js");
     ensureGlobalCoordinatorCwd2(
       isOrchestratorThread(thread) ? { orchestratorThreadId: thread.id } : void 0
     );
@@ -813,8 +1087,8 @@ async function spawnAgentTurn(thread, input, onEvent) {
     onEvent({ type: "exit", data: exitCode });
     const finalized = finalizeParts(parts);
     const rawText = assistantText.trim() || partsToAssistantText(finalized);
-    const text = thread.agent === "brightsy" ? stripBrightsyNdjsonNoise(rawText) : rawText;
-    return { exitCode, sessionId, assistantText: text, parts: finalized, usage };
+    const text2 = thread.agent === "brightsy" ? stripBrightsyNdjsonNoise(rawText) : rawText;
+    return { exitCode, sessionId, assistantText: text2, parts: finalized, usage };
   });
   return {
     pid: child.pid,
@@ -1054,7 +1328,7 @@ import {
   readdirSync,
   readFileSync as readFileSync2
 } from "fs";
-import { createServer } from "net";
+import { createServer as createServer2 } from "net";
 import { basename, dirname, join as join2 } from "path";
 import { execa as execa2 } from "execa";
 import { createInterface as createInterface2 } from "readline";
@@ -1306,7 +1580,7 @@ function getRunMode(worktreePath, repoPath) {
 }
 async function allocatePort() {
   return new Promise((resolve, reject) => {
-    const server = createServer();
+    const server = createServer2();
     server.listen(0, "127.0.0.1", () => {
       const addr = server.address();
       if (!addr || typeof addr === "string") {
@@ -1326,7 +1600,7 @@ async function allocatePortRange(size = PORT_RANGE_SIZE) {
   for (let i = 1; i < size; i++) {
     const candidate = base + i;
     const free = await new Promise((resolve) => {
-      const server = createServer();
+      const server = createServer2();
       server.once("error", () => resolve(false));
       server.listen(candidate, "127.0.0.1", () => {
         server.close(() => resolve(true));
@@ -1679,13 +1953,13 @@ function formatStat(files) {
   return `${n} file${n === 1 ? "" : "s"} changed, ${additions} insertions(+), ${deletions} deletions(-)`;
 }
 function emptyScopeStats() {
-  const z2 = emptyStat();
+  const z3 = emptyStat();
   return {
-    commits: z2,
-    uncommitted: z2,
-    staged: z2,
-    unstaged: z2,
-    last_turn: z2
+    commits: z3,
+    uncommitted: z3,
+    staged: z3,
+    unstaged: z3,
+    last_turn: z3
   };
 }
 function filesFromDiff(nameStatus, numstat, combinedDiff, maxHunk) {
@@ -2674,16 +2948,16 @@ var PASTE_ATTACH_MIN_CHARS = 1200;
 var PASTE_ATTACH_MIN_LINES = 15;
 var PASTED_NAME_RE = /^Pasted text #(\d+)\.txt$/i;
 var PASTED_NAME_ALT_RE = /^pasted-(\d+)\.txt$/i;
-function pastedTextStats(text) {
-  const chars = text.length;
+function pastedTextStats(text2) {
+  const chars = text2.length;
   if (chars === 0) return { chars: 0, lines: 0 };
-  const lines = text.split(/\r\n|\r|\n/).length;
+  const lines = text2.split(/\r\n|\r|\n/).length;
   return { chars, lines };
 }
-function shouldAttachPastedText(text) {
-  const trimmed = text.trim();
+function shouldAttachPastedText(text2) {
+  const trimmed = text2.trim();
   if (!trimmed) return false;
-  const { chars, lines } = pastedTextStats(text);
+  const { chars, lines } = pastedTextStats(text2);
   return chars >= PASTE_ATTACH_MIN_CHARS || lines >= PASTE_ATTACH_MIN_LINES;
 }
 function nextPastedTextName(existing) {
@@ -2694,13 +2968,13 @@ function nextPastedTextName(existing) {
   }
   return `Pasted text #${max + 1}.txt`;
 }
-function buildPastedTextAttachment(text, opts) {
+function buildPastedTextAttachment(text2, opts) {
   return {
     id: opts?.id ?? randomUUID2(),
     name: opts?.name ?? "Pasted text #1.txt",
     kind: "file",
     path: opts?.path,
-    content: text
+    content: text2
   };
 }
 
@@ -2748,9 +3022,9 @@ async function tryClaudeSummary(transcript, opts) {
       { cwd: opts?.cwd, reject: false }
     );
     if (exitCode !== 0) return null;
-    const text = stdout.trim();
-    if (text.length < 40) return null;
-    return text;
+    const text2 = stdout.trim();
+    if (text2.length < 40) return null;
+    return text2;
   } catch {
     return null;
   }
@@ -2799,9 +3073,9 @@ function extractiveSummary(transcript) {
   );
   return parts.join("\n");
 }
-function clipSummary(text) {
-  if (text.length <= MAX_SUMMARY_CHARS) return text;
-  return `${text.slice(0, MAX_SUMMARY_CHARS)}
+function clipSummary(text2) {
+  if (text2.length <= MAX_SUMMARY_CHARS) return text2;
+  return `${text2.slice(0, MAX_SUMMARY_CHARS)}
 
 [\u2026summary truncated\u2026]`;
 }
@@ -3203,7 +3477,7 @@ async function createThread(input, _onSetupLine) {
   return readThread(thread.id) ?? thread;
 }
 async function listLinearIssues(agent, repoPath) {
-  const { getAdapter: getAdapter2 } = await import("./agents-JBD7IAGK.js");
+  const { getAdapter: getAdapter2 } = await import("./agents-TCAK3MXN.js");
   await requireAgent(agent, { requireLinear: true });
   const adapter = getAdapter2(agent);
   if (!adapter.listLinearIssues) {
@@ -3701,13 +3975,13 @@ function resolveConductorCursorAgentId(workspacePath) {
   for (const hash of hashes) {
     const agentsFile = join7(CURSOR_SDK_STORE, hash, "agents.ndjson");
     if (!existsSync9(agentsFile)) continue;
-    let text;
+    let text2;
     try {
-      text = readFileSync7(agentsFile, "utf8");
+      text2 = readFileSync7(agentsFile, "utf8");
     } catch {
       continue;
     }
-    for (const line of text.split("\n")) {
+    for (const line of text2.split("\n")) {
       const trimmed = line.trim();
       if (!trimmed) continue;
       try {
@@ -3746,7 +4020,7 @@ async function adoptThread(input) {
     messages: input.messages ?? []
   });
   writeThread(thread);
-  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-BWJNGEE6.js");
+  const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-AHFTHVBT.js");
   await ensureWorkspace2(repoPath);
   return thread;
 }
@@ -4435,7 +4709,7 @@ function buildReviewRequestAttachment(content, opts) {
 function readExistingReviewRequestFile(worktreePath) {
   return readTextIfPresent(join10(worktreePath, REPO_REVIEW_PATH)) ?? readTextIfPresent(join10(worktreePath, REVIEW_REQUEST_PATH)) ?? readTextIfPresent(join10(worktreePath, LEGACY_REVIEW_REQUEST_PATH));
 }
-async function requestReview(threadRef, send) {
+async function requestReview(threadRef, send2) {
   const from = findThreadByRef(threadRef);
   if (!from) throw new Error(`Thread not found: ${threadRef}`);
   if (isOrchestratorThread(from)) {
@@ -4457,7 +4731,7 @@ async function requestReview(threadRef, send) {
       })
     ]
   });
-  const started = await send(tab.id, REVIEW_REQUEST_PREFILL);
+  const started = await send2(tab.id, REVIEW_REQUEST_PREFILL);
   return { tab: started, from };
 }
 
@@ -4513,8 +4787,8 @@ function buildQuotaHandoffAttachment(from, limitText, fallbackAgent) {
   );
   const recent = from.messages.slice(-8).map((m) => {
     const role = m.role === "user" ? "User" : m.role === "agent" ? "Agent" : "Summary";
-    const text = m.text.trim().replace(/\s+/g, " ").slice(0, 280);
-    return text ? `- ${role}: ${text}` : null;
+    const text2 = m.text.trim().replace(/\s+/g, " ").slice(0, 280);
+    return text2 ? `- ${role}: ${text2}` : null;
   }).filter(Boolean);
   const body = [
     `# Orchestration handoff`,
@@ -4697,7 +4971,7 @@ var Orchestrator = class {
           orphans: orphans.map((o) => ({ path: o.path, repoPath: o.repoPath }))
         });
       }
-      const { autoCleanupOrphansEnabled: autoCleanupOrphansEnabled2 } = await import("./app-settings-ONKMFSEJ.js");
+      const { autoCleanupOrphansEnabled: autoCleanupOrphansEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
       if (autoCleanupOrphansEnabled2() && shouldRunWorktreeCleanup() && orphans.length > 0) {
         await cleanupOrphanWorktrees({ repoPaths });
       }
@@ -4854,7 +5128,7 @@ var Orchestrator = class {
   }
   async finishCreateThread(threadId, prompt) {
     await this.runSetupAfterCreate(threadId);
-    const { autoRunAfterSetupEnabled: autoRunAfterSetupEnabled2 } = await import("./app-settings-ONKMFSEJ.js");
+    const { autoRunAfterSetupEnabled: autoRunAfterSetupEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
     if (autoRunAfterSetupEnabled2()) {
       try {
         await this.startDev(threadId);
@@ -4934,11 +5208,11 @@ var Orchestrator = class {
     return results;
   }
   /** Edit the text of a not-yet-started queued message. */
-  async editQueuedMessage(threadRef, index, text) {
+  async editQueuedMessage(threadRef, index, text2) {
     const thread = this.requireThread(threadRef);
     return withThreadLock(thread.id, async () => {
       const current = this.requireThread(thread.id);
-      const trimmed = text.trim();
+      const trimmed = text2.trim();
       if (!trimmed || index < 0 || index >= current.queue.length) {
         return current;
       }
@@ -5083,10 +5357,19 @@ var Orchestrator = class {
         attachments: sentAttachments ?? thread.attachments
       }
     );
-    const orchestrationReminder = isOrchestratorThread(thread) ? coordinatorTurnReminder({
-      parentId: threadId,
-      goal: thread.sourceRef || thread.title
-    }) : null;
+    const slackInbound = /^(Slack DM|Slack @mention)(?:\n|$)/.test(
+      expandedPrompt.trim()
+    );
+    const orchestrationReminder = isOrchestratorThread(thread) ? [
+      coordinatorTurnReminder({
+        parentId: threadId,
+        goal: thread.sourceRef || thread.title
+      }),
+      slackInbound ? [
+        "This turn is a Slack DM or @mention. Your reply is posted back in Slack \u2014 keep it concise. Sideboard signs it with this Mac's destination name; do not prefix the name yourself.",
+        SLACK_REPLY_FORMATTING
+      ].join("\n") : null
+    ].filter(Boolean).join("\n") : null;
     const artifactReminder = thread.agent !== "brightsy" ? [
       "Sideboard side column (important):",
       "There is no claude.ai Artifact tool here \u2014 that is normal.",
@@ -5126,7 +5409,7 @@ var Orchestrator = class {
     });
     const artifactDirective = isBrightsy ? null : formatArtifactDirective();
     const settings = loadWorkspaceSettings(fresh.worktreePath, fresh.repoPath);
-    const { autoRenameBranchEnabled: autoRenameBranchEnabled2 } = await import("./app-settings-ONKMFSEJ.js");
+    const { autoRenameBranchEnabled: autoRenameBranchEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
     const renameBranchDirective = !isBrightsy && !isOrchestration && autoRenameBranchEnabled2() ? formatRenameBranchDirective(fresh, {
       customPrompt: settings?.prompts?.renameBranch
     }) : null;
@@ -5146,7 +5429,9 @@ var Orchestrator = class {
           goal: fresh.sourceRef || fresh.title || "Orchestration",
           parentId: fresh.id,
           workspaces: inventory,
-          audience: "desktop"
+          audience: /^(Slack DM|Slack @mention)(?:\n|$)/.test(
+            expandedPrompt.trim()
+          ) ? "slack" : "desktop"
         });
       }
     }
@@ -5771,7 +6056,8 @@ var Orchestrator = class {
       isDraft: false,
       reviewDecision: null,
       baseRefName: "",
-      headRefName: ""
+      headRefName: "",
+      isInMergeQueue: false
     };
     await this.persistPrMetaAndMaybeArchive(thread, metaLike);
     return { url: metaLike.url, state };
@@ -5821,7 +6107,7 @@ var Orchestrator = class {
         updateThread(thread.id, { title: meta.title });
       }
     }
-    const { autoArchiveOnMergeEnabled: autoArchiveOnMergeEnabled2 } = await import("./app-settings-ONKMFSEJ.js");
+    const { autoArchiveOnMergeEnabled: autoArchiveOnMergeEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
     const latest = this.requireThread(thread.id);
     if (!shouldAutoArchiveOnPrMerge({
       previousPrState: prevState || null,
@@ -6045,7 +6331,7 @@ var Orchestrator = class {
     this.emit({ type: "status_changed", threadId: archived.id, status: "archived" });
     if (thread.repoPath && !isGlobalRepoPath(thread.repoPath)) {
       try {
-        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-BWJNGEE6.js");
+        const { ensureWorkspace: ensureWorkspace2 } = await import("./workspaces-AHFTHVBT.js");
         await ensureWorkspace2(thread.repoPath);
       } catch {
       }
@@ -6066,7 +6352,7 @@ var Orchestrator = class {
         await runArchiveScript(thread.repoPath, thread.worktreePath);
       } catch {
       }
-      const { deleteBranchOnPurgeEnabled: deleteBranchOnPurgeEnabled2 } = await import("./app-settings-ONKMFSEJ.js");
+      const { deleteBranchOnPurgeEnabled: deleteBranchOnPurgeEnabled2 } = await import("./app-settings-3TLA2EJ7.js");
       const deleteBranch = opts?.deleteBranch ?? deleteBranchOnPurgeEnabled2();
       await removeWorktree(thread.repoPath, thread.worktreePath, {
         deleteBranch: deleteBranch ? thread.branchName : void 0
@@ -6087,7 +6373,7 @@ var Orchestrator = class {
       return restored2;
     }
     if (!existsSync13(thread.worktreePath)) {
-      const { createThreadWorktree: createThreadWorktree2 } = await import("./worktree-ZPSKEZFE.js");
+      const { createThreadWorktree: createThreadWorktree2 } = await import("./worktree-VOCH3WS3.js");
       const { execa: execa6 } = await import("execa");
       const slug = thread.worktreePath.split("/").pop();
       const dest = thread.worktreePath;
@@ -6196,7 +6482,7 @@ async function startOrchestration(opts) {
     sourceRef: "default",
     ...createOpts
   }).catch(async () => {
-    const { resolveDefaultBranch: resolveDefaultBranch2, resolveRepoRoot: resolveRepoRoot2 } = await import("./worktree-ZPSKEZFE.js");
+    const { resolveDefaultBranch: resolveDefaultBranch2, resolveRepoRoot: resolveRepoRoot2 } = await import("./worktree-VOCH3WS3.js");
     const repo = await resolveRepoRoot2(repoPath);
     const def = await resolveDefaultBranch2(repo);
     return createThread({
@@ -6318,7 +6604,7 @@ function formatPlanQuestionsForChat(questions) {
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
+import { z as z2 } from "zod";
 import { basename as basename4 } from "path";
 
 // src/mcp/archive-guard.ts
@@ -6329,379 +6615,1144 @@ function mcpArchiveBlockedReason(thread) {
   return null;
 }
 
-// src/mcp/server.ts
-var MAX_ORCH_THREADS = 5;
-var CREATE_THREAD_TIMEOUT_MS = 9e4;
-function withTimeout(promise, ms, label) {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => {
-      reject(new Error(`${label} timed out after ${Math.round(ms / 1e3)}s`));
-    }, ms);
-    promise.then(
-      (value) => {
-        clearTimeout(timer);
-        resolve(value);
-      },
-      (err) => {
-        clearTimeout(timer);
-        reject(err);
-      }
-    );
+// src/mcp/slack-tools.ts
+import { z } from "zod";
+
+// src/slack/api.ts
+var SLACK_API = "https://slack.com/api";
+var SlackApiError = class extends Error {
+  constructor(method, slackError) {
+    super(`Slack ${method}: ${slackError}`);
+    this.method = method;
+    this.slackError = slackError;
+    this.name = "SlackApiError";
+  }
+  method;
+  slackError;
+};
+async function slackApi(token, method, params, fetchImpl) {
+  const doFetch = fetchImpl ?? fetch;
+  const body = new URLSearchParams();
+  if (params) {
+    for (const [key, value] of Object.entries(params)) {
+      if (value === void 0) continue;
+      body.set(key, String(value));
+    }
+  }
+  const res = await doFetch(`${SLACK_API}/${method}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body
   });
-}
-async function startMcpServer() {
-  const orch = getOrchestrator();
-  try {
-    const { maxConcurrentAgents: maxConcurrentAgents2 } = await import("./app-settings-ONKMFSEJ.js");
-    orch.setMaxConcurrent(maxConcurrentAgents2());
-  } catch {
+  const json = await res.json();
+  if (!json.ok) {
+    throw new SlackApiError(method, json.error || `HTTP ${res.status}`);
   }
-  try {
-    await orch.reconcile(void 0, { reclaimStaleTurns: false, drainQueues: false });
-  } catch (err) {
-    console.error(
-      "[sideboard-mcp] reconcile on boot failed (continuing):",
-      err instanceof Error ? err.message : err
+  return json;
+}
+async function slackAuthTest(token) {
+  return slackApi(token, "auth.test");
+}
+
+// src/slack/destination.ts
+function isChannelId(raw) {
+  return /^[CGD][A-Z0-9]+$/i.test(raw);
+}
+function isUserId(raw) {
+  return /^U[A-Z0-9]+$/i.test(raw);
+}
+function isEmail(raw) {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(raw);
+}
+function normalizeSlackHandle(raw) {
+  let s = raw.trim();
+  const mention = s.match(/^<@([UW][A-Z0-9]+)(?:\|[^>]+)?>$/i);
+  if (mention?.[1]) return mention[1];
+  const channelMention = s.match(/^<#([CGD][A-Z0-9]+)(?:\|[^>]+)?>$/i);
+  if (channelMention?.[1]) return channelMention[1];
+  if (s.startsWith("#") || s.startsWith("@")) s = s.slice(1);
+  return s.trim();
+}
+async function listSlackUsers(token, opts) {
+  const query = opts?.query?.trim().toLowerCase() ?? "";
+  const limit = Math.min(200, Math.max(1, opts?.limit ?? 50));
+  const members = [];
+  let cursor;
+  do {
+    const data = await slackApi(
+      token,
+      "users.list",
+      {
+        limit: 200,
+        cursor: cursor || void 0
+      },
+      opts?.fetchImpl
     );
+    for (const m of data.members ?? []) {
+      if (!m.id || m.deleted || m.is_bot) continue;
+      members.push(m);
+    }
+    cursor = data.response_metadata?.next_cursor?.trim() || void 0;
+  } while (cursor && members.length < 2e3);
+  const mapped = members.map((m) => ({
+    id: m.id,
+    name: m.name ?? m.id,
+    real_name: m.profile?.real_name,
+    display_name: m.profile?.display_name,
+    email: m.profile?.email
+  }));
+  const filtered = query ? mapped.filter((u) => {
+    const hay = [u.name, u.real_name, u.display_name, u.email, u.id].filter(Boolean).join(" ").toLowerCase();
+    return hay.includes(query);
+  }) : mapped;
+  return filtered.slice(0, limit);
+}
+async function findUserId(token, handle, fetchImpl) {
+  if (isUserId(handle)) {
+    return { id: handle, name: handle };
   }
-  const server = new McpServer({
-    name: "sideboard",
-    version: "0.1.0"
-  });
-  server.tool(
-    "list_workspaces",
-    "List registered Sideboard workspaces (repos). Each line is name, path, and github:owner/repo when resolvable \u2014 use path as repoPath for list_branches/list_prs/list_issues/create_thread.",
-    {},
-    async () => {
-      const workspaces = orch.listWorkspaces();
-      const lines = await Promise.all(
-        workspaces.map(async (w) => {
-          const slug = await resolveGithubRepoSlug(w.path).catch(() => null);
-          return slug ? `${w.name}  ${w.path}  github:${slug}` : `${w.name}  ${w.path}`;
-        })
+  if (isEmail(handle)) {
+    try {
+      const data = await slackApi(
+        token,
+        "users.lookupByEmail",
+        { email: handle },
+        fetchImpl
       );
-      return {
-        content: [
-          { type: "text", text: lines.join("\n") || "(no workspaces)" }
-        ]
-      };
+      if (data.user?.id) {
+        return {
+          id: data.user.id,
+          name: data.user.name ?? data.user.id,
+          real_name: data.user.profile?.real_name,
+          display_name: data.user.profile?.display_name,
+          email: data.user.profile?.email
+        };
+      }
+    } catch {
     }
+  }
+  const users = await listSlackUsers(token, { query: handle, limit: 20, fetchImpl });
+  const exact = users.find(
+    (u) => u.name.toLowerCase() === handle.toLowerCase() || u.display_name?.toLowerCase() === handle.toLowerCase() || u.real_name?.toLowerCase() === handle.toLowerCase() || u.email?.toLowerCase() === handle.toLowerCase()
   );
-  server.tool(
-    "list_threads",
-    "List Sideboard threads across all workspaces (one summary line each \u2014 token-frugal). Each line ends with sideboard://thread/<id> \u2014 use that URL in markdown links so the UI can open the chat.",
-    {},
-    async () => {
-      const threads = orch.getThreads(true);
-      const lines = threads.map((t) => {
-        const repo = t.repoPath === GLOBAL_WORKSPACE_ID ? "Orchestration" : basename4(t.repoPath) || t.repoPath;
-        return `${t.id.slice(0, 8)}  ${t.status.padEnd(9)}  ${t.agent.padEnd(8)}  ${repo}  ${t.sourceType}:${t.sourceRef}  ${t.title}  sideboard://thread/${t.id}${t.devPort ? `  http://localhost:${t.devPort}` : ""}`;
-      });
-      return {
-        content: [{ type: "text", text: lines.join("\n") || "(no threads)" }]
-      };
-    }
+  if (exact) return exact;
+  if (users.length === 1) return users[0];
+  if (users.length === 0) {
+    throw new Error(`No Slack user matching "${handle}"`);
+  }
+  throw new Error(
+    `Ambiguous Slack user "${handle}". Matches: ${users.slice(0, 5).map((u) => `${u.name} (${u.id})`).join(", ")}. Pass a user id (U\u2026) or use slack_list_users.`
   );
-  server.tool(
-    "get_thread",
-    "Get a compact thread summary by id/ref",
-    { ref: z.string() },
-    async ({ ref }) => {
-      const t = orch.getThread(ref);
-      if (!t) {
-        return { content: [{ type: "text", text: `Thread not found: ${ref}` }], isError: true };
-      }
-      const summary = {
-        id: t.id,
-        title: t.title,
-        status: t.status,
-        agent: t.agent,
-        sourceType: t.sourceType,
-        sourceRef: t.sourceRef,
-        branchName: t.branchName,
-        worktreePath: t.worktreePath,
-        sessionId: t.sessionId,
-        queueLength: t.queue.length,
-        messageCount: t.messages.length,
-        devPort: t.devPort,
-        prUrl: t.prUrl,
-        lastError: t.lastError ?? null
-      };
-      return { content: [{ type: "text", text: JSON.stringify(summary, null, 2) }] };
-    }
+}
+async function openDmChannel(token, userId, fetchImpl) {
+  const data = await slackApi(
+    token,
+    "conversations.open",
+    { users: userId },
+    fetchImpl
   );
-  server.tool(
-    "present_artifact",
-    "Show an HTML, SVG, markdown, or React document in Sideboard\u2019s Claude-style side column (desktop). Use instead of claude.ai\u2019s artifact tool \u2014 pass the full document content. Prefer type=html for interactive pages. For type=react, pass a single component module that `export default`s a component (JSX/TSX ok) \u2014 Sideboard bootstraps React/ReactDOM/Babel and renders it; only `react`/`react-dom` imports are available, no other npm packages.",
+  const id = data.channel?.id?.trim();
+  if (!id) throw new Error(`Could not open Slack DM with user ${userId}`);
+  return id;
+}
+async function resolveChannelByName(token, name, fetchImpl) {
+  const data = await slackApi(
+    token,
+    "conversations.list",
     {
-      title: z.string().describe("Short title shown in the artifact pane header"),
-      type: z.enum(["html", "svg", "markdown", "react"]).describe(
-        "Artifact kind \u2014 html opens an iframe preview; react transpiles and renders a default-exported component in a sandboxed iframe"
-      ),
-      content: z.string().describe(
-        "Full document body (complete HTML page, SVG markup, markdown, or a React component module with a default export)"
-      ),
-      artifact_id: z.string().optional().describe("Stable id when updating the same artifact across turns")
+      types: "public_channel,private_channel",
+      exclude_archived: true,
+      limit: 200
     },
-    async ({ title, type, artifact_id }) => {
-      const id = artifact_id?.trim() || `artifact_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
-      const payload = {
-        ok: true,
-        artifact_id: id,
-        title,
-        type,
-        message: "Artifact accepted. Sideboard desktop opens it in the side column beside chat."
+    fetchImpl
+  );
+  const match = (data.channels ?? []).find((c) => c.name?.toLowerCase() === name.toLowerCase());
+  if (!match?.id) throw new Error(`No Slack channel named #${name}`);
+  return match.id;
+}
+async function resolveSlackDestination(token, destination, opts) {
+  const raw = destination.trim();
+  if (!raw) throw new Error("destination is required");
+  const hadAt = raw.startsWith("@") || /^<@/i.test(raw);
+  const hadHash = raw.startsWith("#") || /^<#/i.test(raw);
+  const handle = normalizeSlackHandle(raw);
+  if (isChannelId(handle)) {
+    return {
+      channelId: handle,
+      kind: handle.toUpperCase().startsWith("D") ? "dm" : "channel",
+      label: handle
+    };
+  }
+  if (isUserId(handle) || hadAt || isEmail(handle)) {
+    const user = await findUserId(token, handle, opts?.fetchImpl);
+    if (opts?.forRead) {
+      const channelId2 = await openDmChannel(token, user.id, opts?.fetchImpl);
+      return {
+        channelId: channelId2,
+        kind: "user",
+        userId: user.id,
+        label: user.display_name || user.real_name || user.name
       };
-      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
     }
-  );
-  server.tool(
-    "ask_user",
-    "Ask the user clarifying multiple-choice questions in Sideboard\u2019s composer (plan mode). Before calling, write a short chat message explaining the decision and what each option means. Include a description on every option. Use for approach forks and requirements \u2014 not for \u201Cis the plan ready?\u201D. After calling, stop and wait for their next message with answers.",
-    {
-      questions: z.array(
-        z.object({
-          question: z.string().describe("Full question text ending with ?"),
-          header: z.string().max(24).optional().describe("Short label shown above the question"),
-          multiSelect: z.boolean().optional().describe("Allow selecting multiple options"),
-          options: z.array(
-            z.object({
-              label: z.string(),
-              description: z.string().optional().describe("What this option means / when to choose it (strongly preferred)")
-            })
-          ).min(2).max(6).describe("2\u20136 choices (Sideboard also offers Other)")
-        })
-      ).min(1).max(4).describe("1\u20134 questions")
-    },
-    async ({ questions }) => {
-      const payload = {
-        ok: true,
-        questions,
-        message: "Questions shown in Sideboard\u2019s composer. Wait for the user\u2019s next message with their answers before continuing."
+    const channelId = await openDmChannel(token, user.id, opts?.fetchImpl);
+    return {
+      channelId,
+      kind: "user",
+      userId: user.id,
+      label: user.display_name || user.real_name || user.name
+    };
+  }
+  if (hadHash) {
+    const channelId = await resolveChannelByName(token, handle, opts?.fetchImpl);
+    return { channelId, kind: "channel", label: `#${handle}` };
+  }
+  try {
+    const channelId = await resolveChannelByName(token, handle, opts?.fetchImpl);
+    return { channelId, kind: "channel", label: `#${handle}` };
+  } catch (channelErr) {
+    try {
+      const user = await findUserId(token, handle, opts?.fetchImpl);
+      const channelId = await openDmChannel(token, user.id, opts?.fetchImpl);
+      return {
+        channelId,
+        kind: "user",
+        userId: user.id,
+        label: user.display_name || user.real_name || user.name
       };
-      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
+    } catch {
+      throw channelErr;
     }
-  );
-  server.tool(
-    "present_plan",
-    "Save the implementation plan as markdown to .context/attachments/plan.md and show it in Sideboard chat for user approval (Copy / Hand off / Approve). Call this when the plan is ready \u2014 required in plan mode. Pass the full plan body in content. Then Claude should call ExitPlanMode.",
-    {
-      title: z.string().optional().describe("Short plan title (defaults to Plan)"),
-      content: z.string().min(1).describe("Full plan markdown (headings, steps, risks, open questions)"),
-      thread_id: z.string().optional().describe("Sideboard thread id when cwd is not the worktree")
-    },
-    async ({ title, content, thread_id }) => {
-      const { writePlanFile: writePlanFile2 } = await import("./plan-file-6O7G4VPQ.js");
-      let root = process.cwd();
-      if (thread_id?.trim()) {
-        const t = orch.getThread(thread_id.trim());
-        if (t?.worktreePath?.trim()) root = t.worktreePath;
-      }
-      const path = writePlanFile2(root, content);
-      const payload = {
-        ok: true,
-        path,
-        title: title?.trim() || "Plan",
-        message: "Plan saved to .context/attachments/plan.md and shown in Sideboard chat for approval."
-      };
-      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
+  }
+}
+
+// src/slack/github-link.ts
+function labelGithubUrl(url) {
+  const raw = url.trim();
+  if (!raw) return null;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (!/(^|\.)github\.com$/i.test(parsed.hostname)) return null;
+  const path = parsed.pathname;
+  const hash = parsed.hash || "";
+  const pr = path.match(/\/([^/]+)\/([^/]+)\/pull\/(\d+)/i);
+  if (pr) {
+    const n = pr[3];
+    if (/#discussion_r\d+/i.test(hash) || /#pullrequestreview-\d+/i.test(hash)) {
+      return { kind: "comment", label: `PR #${n} comment`, url: raw };
+    }
+    if (/#issuecomment-\d+/i.test(hash)) {
+      return { kind: "comment", label: `PR #${n} comment`, url: raw };
+    }
+    return { kind: "pr", label: `PR #${n}`, url: raw };
+  }
+  const issueComment = path.match(/\/([^/]+)\/([^/]+)\/issues\/(\d+)/i);
+  if (issueComment && /#issuecomment-\d+/i.test(hash)) {
+    return { kind: "comment", label: `Issue #${issueComment[3]} comment`, url: raw };
+  }
+  const blob = path.match(/\/([^/]+)\/([^/]+)\/blob\/[^/]+\/(.+)$/i);
+  if (blob) {
+    const filePath = decodeURIComponent(blob[3]);
+    const fileName = filePath.split("/").pop() || filePath;
+    const line = hash.match(/^#L(\d+)(?:-L(\d+))?$/i);
+    if (line) {
+      const start = line[1];
+      const end = line[2];
+      const loc = end && end !== start ? `${start}-${end}` : start;
+      return { kind: "code", label: `${fileName}:${loc}`, url: raw };
+    }
+    return { kind: "code", label: fileName, url: raw };
+  }
+  return { kind: "other", label: "GitHub", url: raw };
+}
+function appendGithubLink(text2, githubUrl) {
+  const body = text2.trimEnd();
+  if (!githubUrl?.trim()) return body;
+  const labeled = labelGithubUrl(githubUrl);
+  if (!labeled) {
+    return body ? `${body}
+${githubUrl.trim()}` : githubUrl.trim();
+  }
+  const link = `<${labeled.url}|${labeled.label}>`;
+  return body ? `${body}
+${link}` : link;
+}
+
+// src/slack/outbound-watch.ts
+import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
+import { join as join12 } from "path";
+
+// src/slack/workspaces.ts
+import { join as join11 } from "path";
+function storePath() {
+  return join11(appDataDir(), "slack-workspaces.json");
+}
+function readStore() {
+  try {
+    const path = storePath();
+    const wasEncrypted = isSecureFileEncrypted(path);
+    const parsed = readSecureJson(path);
+    const workspaces = Array.isArray(parsed?.workspaces) ? parsed.workspaces : [];
+    if (workspaces.length > 0 && !wasEncrypted && resolveVaultKey()) {
+      writeSecureJson(path, { workspaces });
+    }
+    return workspaces;
+  } catch {
+    return [];
+  }
+}
+function writeStore(workspaces) {
+  writeSecureJson(storePath(), { workspaces });
+  return workspaces;
+}
+function toInfo(ws) {
+  return {
+    team_id: ws.team_id,
+    team_name: ws.team_name,
+    user_id: ws.user_id,
+    has_bot_token: Boolean(ws.bot_token),
+    has_user_token: Boolean(ws.user_token),
+    connected_at: ws.connected_at
+  };
+}
+function listSlackWorkspaces() {
+  return readStore().map(toInfo).sort((a, b) => a.team_name.localeCompare(b.team_name));
+}
+function listSlackWorkspacesRaw() {
+  return readStore();
+}
+function getSlackWorkspace(teamId) {
+  const id = teamId.trim();
+  if (!id) return null;
+  return readStore().find(
+    (ws) => ws.team_id === id || ws.team_name.toLowerCase() === id.toLowerCase()
+  ) ?? null;
+}
+function upsertSlackWorkspace(entry) {
+  const workspaces = readStore().filter((ws) => ws.team_id !== entry.team_id);
+  workspaces.push(entry);
+  writeStore(workspaces);
+  return toInfo(entry);
+}
+function disconnectSlackWorkspace(teamId) {
+  const id = teamId.trim();
+  writeStore(readStore().filter((ws) => ws.team_id !== id));
+  return listSlackWorkspaces();
+}
+function tokenKind(token) {
+  if (token.startsWith("xoxb-")) return "bot";
+  if (token.startsWith("xoxp-") || token.startsWith("xoxe.xoxp-")) return "user";
+  return "unknown";
+}
+async function connectSlackToken(rawToken) {
+  const token = rawToken.trim();
+  if (!token) throw new Error("Paste a Slack bot (xoxb-) or user (xoxp-) token");
+  const auth = await slackAuthTest(token);
+  const teamId = auth.team_id?.trim();
+  if (!teamId) throw new Error("Slack auth.test did not return a team_id");
+  const existing = getSlackWorkspace(teamId);
+  const kind = tokenKind(token);
+  const next = {
+    team_id: teamId,
+    team_name: auth.team?.trim() || existing?.team_name || teamId,
+    user_id: auth.user_id?.trim() || existing?.user_id,
+    bot_token: kind === "bot" ? token : existing?.bot_token,
+    user_token: kind === "user" || kind === "unknown" ? token : existing?.user_token,
+    scopes: existing?.scopes,
+    connected_at: existing?.connected_at || (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (kind === "unknown" && auth.bot_id) {
+    next.bot_token = token;
+    next.user_token = existing?.user_token;
+  }
+  return upsertSlackWorkspace(next);
+}
+function slackTokenFor(ws, kind = "read") {
+  if (kind === "search") {
+    const token2 = ws.user_token?.trim();
+    if (!token2) {
+      throw new Error(
+        `Slack search needs a user token for ${ws.team_name}. Reconnect via Account \u2192 Slack (browser) or paste an xoxp- token.`
+      );
+    }
+    return token2;
+  }
+  const token = (kind === "write" ? ws.bot_token || ws.user_token : ws.user_token || ws.bot_token)?.trim();
+  if (!token) {
+    throw new Error(`Slack workspace ${ws.team_name} has no token`);
+  }
+  return token;
+}
+function requireSlackWorkspace(teamId) {
+  const ws = getSlackWorkspace(teamId);
+  if (!ws) {
+    const connected = listSlackWorkspaces();
+    const hint = connected.length === 0 ? "Connect a workspace in Account \u2192 Slack workspaces." : `Connected: ${connected.map((t) => `${t.team_name} (${t.team_id})`).join(", ")}`;
+    throw new Error(`Unknown Slack team_id "${teamId}". ${hint}`);
+  }
+  return ws;
+}
+
+// src/slack/outbound-watch.ts
+var MAX_WATCHES = 40;
+var WATCH_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var POLL_INTERVAL_MS = 12e3;
+var lastPollMs = 0;
+var nameCache = /* @__PURE__ */ new Map();
+function storePath2() {
+  return join12(appDataDir(), "slack-outbound-watch.json");
+}
+function watchId(teamId, channelId, ts) {
+  return `${teamId}:${channelId}:${ts}`;
+}
+function badgeId(teamId, userId) {
+  return `${teamId}:${userId}`;
+}
+function slackArchiveUrl(channelId, ts) {
+  return `https://slack.com/archives/${channelId}/p${ts.replace(".", "")}`;
+}
+function initialsFromName(name) {
+  const parts = name.trim().split(/\s+/).filter(Boolean);
+  if (parts.length === 0) return "?";
+  if (parts.length === 1) {
+    const w = parts[0];
+    return (w.slice(0, 2) || "?").toUpperCase();
+  }
+  return `${parts[0][0] ?? ""}${parts[parts.length - 1][0] ?? ""}`.toUpperCase();
+}
+function hueFromId(id) {
+  let h = 0;
+  for (const c of id) h = h * 31 + c.charCodeAt(0) >>> 0;
+  return h % 360;
+}
+function tsNewer(a, b) {
+  return Number(a) > Number(b);
+}
+function readStore2() {
+  const path = storePath2();
+  if (!existsSync14(path)) return [];
+  try {
+    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse(readFileSync9(path, "utf8"));
+    return Array.isArray(parsed?.watches) ? parsed.watches : [];
+  } catch {
+    return [];
+  }
+}
+function writeStore2(watches) {
+  writePrivateFile(storePath2(), `${JSON.stringify({ watches }, null, 2)}
+`);
+  return watches;
+}
+function pruneWatches(watches, nowMs = Date.now()) {
+  const cutoff = nowMs - WATCH_TTL_MS;
+  const kept = watches.filter((w) => {
+    const posted = Date.parse(w.postedAt);
+    return Number.isFinite(posted) ? posted >= cutoff : true;
+  });
+  if (kept.length <= MAX_WATCHES) return kept;
+  return kept.slice().sort((a, b) => b.postedAt.localeCompare(a.postedAt)).slice(0, MAX_WATCHES);
+}
+function recordSlackOutboundWatch(input) {
+  const ts = input.ts.trim();
+  const channelId = input.channelId.trim();
+  const teamId = input.teamId.trim();
+  if (!ts || !channelId || !teamId) return null;
+  const owner = input.ownerUserId?.trim();
+  const toUser = input.toUserId?.trim();
+  if (toUser && owner && toUser === owner) return null;
+  const id = watchId(teamId, channelId, ts);
+  const next = {
+    id,
+    teamId,
+    channelId,
+    ts,
+    threadTs: input.threadTs?.trim() || ts,
+    kind: input.kind === "dm" ? "dm" : "channel",
+    toUserId: toUser,
+    toLabel: input.toLabel.trim() || toUser || channelId,
+    ownerUserId: owner,
+    postedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lastSeenTs: ts,
+    unread: false,
+    permalink: slackArchiveUrl(channelId, ts)
+  };
+  const watches = pruneWatches(readStore2().filter((w) => w.id !== id));
+  watches.unshift(next);
+  writeStore2(pruneWatches(watches));
+  return next;
+}
+function isHumanReply(msg, watch) {
+  const ts = msg.ts?.trim();
+  if (!ts || ts === watch.ts) return false;
+  if (!tsNewer(ts, watch.lastSeenTs)) return false;
+  if (msg.bot_id) return false;
+  if (msg.subtype) return false;
+  const user = msg.user?.trim();
+  if (!user) return false;
+  if (watch.ownerUserId && user === watch.ownerUserId) return false;
+  return true;
+}
+function displayName(user) {
+  const fromProfile = user.profile?.display_name?.trim() || user.profile?.real_name?.trim();
+  return fromProfile || user.real_name?.trim() || user.name?.trim() || "";
+}
+async function resolveUserName(token, userId, fallback, fetchImpl) {
+  const cached = nameCache.get(userId);
+  if (cached) return cached;
+  try {
+    const data = await slackApi(token, "users.info", { user: userId }, fetchImpl);
+    const name = displayName(data.user ?? {}) || fallback;
+    nameCache.set(userId, name);
+    return name;
+  } catch {
+    return fallback;
+  }
+}
+async function resolvePermalink(token, channelId, ts, fetchImpl) {
+  try {
+    const data = await slackApi(
+      token,
+      "chat.getPermalink",
+      { channel: channelId, message_ts: ts },
+      fetchImpl
+    );
+    if (data.permalink?.startsWith("http")) return data.permalink;
+  } catch {
+  }
+  return slackArchiveUrl(channelId, ts);
+}
+async function fetchMessages(token, watch, fetchImpl) {
+  const out = [];
+  try {
+    const data = await slackApi(
+      token,
+      "conversations.replies",
+      {
+        channel: watch.channelId,
+        ts: watch.threadTs,
+        oldest: watch.lastSeenTs,
+        inclusive: false,
+        limit: 50
+      },
+      fetchImpl
+    );
+    out.push(...data.messages ?? []);
+  } catch {
+  }
+  if (watch.kind === "dm" || watch.channelId.startsWith("D")) {
+    try {
+      const data = await slackApi(
+        token,
+        "conversations.history",
+        {
+          channel: watch.channelId,
+          oldest: watch.lastSeenTs,
+          inclusive: false,
+          limit: 50
+        },
+        fetchImpl
+      );
+      out.push(...data.messages ?? []);
+    } catch {
+    }
+  }
+  return out;
+}
+function listSlackReplyBadges() {
+  const unread = readStore2().filter((w) => w.unread && w.replyUserId && w.permalink);
+  const byUser = /* @__PURE__ */ new Map();
+  for (const w of unread) {
+    const id = badgeId(w.teamId, w.replyUserId);
+    const prev = byUser.get(id);
+    if (!prev || tsNewer(w.replyTs || "", prev.replyTs || "")) {
+      byUser.set(id, w);
+    }
+  }
+  return [...byUser.entries()].map(([id, w]) => {
+    const userName = w.replyUserName || w.toLabel || "Slack";
+    return {
+      id,
+      userId: w.replyUserId,
+      userName,
+      initials: initialsFromName(userName),
+      hue: hueFromId(w.replyUserId),
+      permalink: w.permalink || slackArchiveUrl(w.channelId, w.replyTs || w.ts),
+      label: w.toLabel,
+      preview: w.replyPreview,
+      repliedAt: w.replyTs || w.postedAt
+    };
+  }).sort((a, b) => b.repliedAt.localeCompare(a.repliedAt));
+}
+function dismissSlackReplyBadge(badgeKey) {
+  const key = badgeKey.trim();
+  const watches = readStore2().map((w) => {
+    if (!w.unread || !w.replyUserId) return w;
+    if (badgeId(w.teamId, w.replyUserId) !== key) return w;
+    return { ...w, unread: false };
+  });
+  writeStore2(watches);
+  return listSlackReplyBadges();
+}
+function permalinkForSlackReplyBadge(badgeKey) {
+  return listSlackReplyBadges().find((b) => b.id === badgeKey)?.permalink ?? null;
+}
+async function refreshSlackReplyBadges(opts) {
+  const now = opts?.now ?? Date.now();
+  if (!opts?.force && now - lastPollMs < POLL_INTERVAL_MS) {
+    return listSlackReplyBadges();
+  }
+  lastPollMs = now;
+  const existing = readStore2();
+  let watches = pruneWatches(existing, now);
+  let changed = watches.length !== existing.length;
+  for (let i = 0; i < watches.length; i++) {
+    const watch = watches[i];
+    const ws = getSlackWorkspace(watch.teamId);
+    if (!ws) continue;
+    let token;
+    try {
+      token = slackTokenFor(ws, "read");
+    } catch {
+      continue;
+    }
+    const messages = await fetchMessages(token, watch, opts?.fetchImpl);
+    const replies = messages.filter((m) => isHumanReply(m, watch)).sort((a, b) => Number(a.ts) - Number(b.ts));
+    const latest = replies[replies.length - 1];
+    if (!latest?.ts || !latest.user) continue;
+    const fallback = watch.toUserId === latest.user ? watch.toLabel : latest.user;
+    const replyUserName = await resolveUserName(
+      token,
+      latest.user,
+      fallback,
+      opts?.fetchImpl
+    );
+    const permalink = await resolvePermalink(
+      token,
+      watch.channelId,
+      latest.ts,
+      opts?.fetchImpl
+    );
+    watches[i] = {
+      ...watch,
+      lastSeenTs: latest.ts,
+      unread: true,
+      replyUserId: latest.user,
+      replyUserName,
+      replyTs: latest.ts,
+      replyPreview: (latest.text ?? "").slice(0, 140),
+      permalink
+    };
+    changed = true;
+  }
+  if (changed) writeStore2(watches);
+  return listSlackReplyBadges();
+}
+
+// src/mcp/slack-tools.ts
+function text(payload, isError = false) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(payload, null, 2) }],
+    ...isError ? { isError: true } : {}
+  };
+}
+function fail(err) {
+  return text(
+    { error: err instanceof Error ? err.message : String(err) },
+    true
+  );
+}
+function registerSlackTools(server) {
+  server.tool(
+    "list_teams",
+    "List Slack workspaces connected in Sideboard Account settings. Each row is team_id + name. Pass team_id to slack_list_channels, slack_list_users, slack_search, slack_read, and slack_post.",
+    {},
+    async () => {
+      const teams = listSlackWorkspaces();
+      if (teams.length === 0) {
+        return text({
+          teams: [],
+          hint: "No Slack workspaces connected. Add one in Account \u2192 Slack workspaces (paste xoxb-/xoxp- or browser sign-in)."
+        });
+      }
+      return text({
+        teams: teams.map((t) => ({
+          team_id: t.team_id,
+          name: t.team_name,
+          search: t.has_user_token
+        }))
+      });
     }
   );
   server.tool(
-    "present_schema",
-    "Open Sideboard\u2019s schema-driven CMS side column (filterable table and/or form). Pass JSON Schema + schemaUi (Brightsy extensions supported). Use datasource=brightsy with resource_id (record type UUID) when logged into Brightsy; use datasource=inline with embedded resource/records for any other source.",
+    "slack_list_channels",
+    "List channels in a connected Slack workspace. Pass team_id from list_teams.",
     {
-      title: z.string().describe("Pane title"),
-      mode: z.enum(["table", "form"]).optional().describe("table = list/filter records; form = edit one record"),
-      datasource: z.enum(["brightsy", "inline"]).optional().describe("brightsy resolves via login; inline uses embedded resource/records"),
-      resource_id: z.string().optional().describe("Brightsy record type UUID (or generic resource id)"),
-      record_id: z.string().optional().describe("Record id when opening form mode"),
-      resource: z.record(z.unknown()).optional().describe("Inline { id, title, schema, schemaUi?, slug? }"),
-      record: z.record(z.unknown()).optional().describe("Inline record { id, data, published_at? }"),
-      records: z.array(z.record(z.unknown())).optional().describe("Inline records for table mode"),
-      pane_id: z.string().optional().describe("Stable pane id across updates")
+      team_id: z.string(),
+      limit: z.number().optional()
     },
-    async (args) => {
-      const id = args.pane_id?.trim() || `schema_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
-      const payload = {
-        ok: true,
-        pane_id: id,
-        title: args.title,
-        mode: args.mode ?? (args.record_id || args.record ? "form" : "table"),
-        datasource: args.datasource ?? (args.resource ? "inline" : "brightsy"),
-        resource_id: args.resource_id,
-        record_id: args.record_id,
-        message: "Schema pane accepted. Sideboard desktop opens the CMS column beside chat."
-      };
-      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
+    async ({ team_id, limit }) => {
+      try {
+        const ws = requireSlackWorkspace(team_id);
+        const token = slackTokenFor(ws, "read");
+        const data = await slackApi(token, "conversations.list", {
+          types: "public_channel,private_channel",
+          exclude_archived: true,
+          limit: Math.min(200, Math.max(1, limit ?? 100))
+        });
+        return text({
+          team_id: ws.team_id,
+          team_name: ws.team_name,
+          channels: (data.channels ?? []).map((c) => ({
+            id: c.id,
+            name: c.name,
+            private: Boolean(c.is_private),
+            member: Boolean(c.is_member)
+          }))
+        });
+      } catch (err) {
+        return fail(err);
+      }
     }
   );
   server.tool(
-    "present_files",
-    "Open Sideboard\u2019s Files column (CMS-style file manager: browse, upload, pick). Use datasource=brightsy when the user is logged into Brightsy account storage; datasource=memory for a session-local demo store. Prefer this over claiming a file manager UI is unavailable. Pair with present_schema when editing records that need media.",
+    "slack_list_users",
+    "List or search people in a connected Slack workspace (for DMs / @mentions). Pass team_id from list_teams. Optional query matches name, display name, real name, or email.",
     {
-      title: z.string().optional().describe("Pane title (default: Files)"),
-      datasource: z.enum(["brightsy", "memory"]).optional().describe("brightsy = account storage via login; memory = session demo store"),
-      path: z.string().optional().describe("Initial folder path (e.g. public)"),
-      pane_id: z.string().optional().describe("Stable pane id across updates")
+      team_id: z.string(),
+      query: z.string().optional(),
+      limit: z.number().optional()
     },
-    async (args) => {
-      const id = args.pane_id?.trim() || `files_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
-      const payload = {
-        ok: true,
-        pane_id: id,
-        title: args.title?.trim() || "Files",
-        datasource: args.datasource ?? "brightsy",
-        path: args.path,
-        message: "Files pane accepted. Sideboard desktop opens the Files column beside chat."
-      };
-      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
+    async ({ team_id, query, limit }) => {
+      try {
+        const ws = requireSlackWorkspace(team_id);
+        const token = slackTokenFor(ws, "read");
+        const users = await listSlackUsers(token, { query, limit });
+        return text({
+          team_id: ws.team_id,
+          team_name: ws.team_name,
+          query: query?.trim() || void 0,
+          users
+        });
+      } catch (err) {
+        return fail(err);
+      }
     }
   );
-  if (sideboardMcpProfile() !== "worktree") {
-    const { resolveNewThreadOptions: resolveNewThreadOptions2, resolveThreadDefaults: resolveThreadDefaults2 } = await import("./app-settings-ONKMFSEJ.js");
-    const accountDefaults = resolveThreadDefaults2();
-    const accountDefaultsHint = `Account defaults: agent=${accountDefaults.agent}, model=${accountDefaults.model?.trim() || "Auto"}, effort=${accountDefaults.effort}`;
-    server.tool(
-      "create_thread",
-      `Create a new worktree thread (chat) from branch, pr, or ticket. Pass repoPath from list_workspaces. From an orchestration chat, omit parentThreadId (Sideboard binds the child to this chat) or pass the exact id from the turn reminder \u2014 never invent a uuid. Prefer omitting agent/model so Sideboard applies ${accountDefaultsHint}. Then use send_to_thread to chat.`,
-      {
-        sourceType: z.enum(["branch", "pr", "ticket"]),
-        sourceRef: z.string(),
-        agent: z.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(`Omit to use Account default agent (${accountDefaults.agent})`),
-        model: z.string().nullable().optional().describe(
-          `Usually omit to use Account default model (${accountDefaults.model?.trim() || "Auto"}). Pass null only to force Auto / agent-default.`
-        ),
-        repoPath: z.string(),
-        title: z.string().optional(),
-        parentThreadId: z.string().optional().describe(
-          "Orchestration: omit (preferred) or pass YOUR chat id from the turn reminder / AGENTS.md. Do not invent uuids."
-        )
-      },
-      async (args) => {
-        const envParentId = process.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID?.trim() || "";
-        let parentId = args.parentThreadId?.trim() || "";
-        let parent = parentId ? orch.getThread(parentId) : null;
-        let parentCorrectedFrom;
-        if (envParentId) {
-          const envParent = orch.getThread(envParentId);
-          if (envParent) {
-            if (parentId && parentId !== envParentId) parentCorrectedFrom = parentId;
-            else if (!parentId) parentCorrectedFrom = void 0;
-            parentId = envParentId;
-            parent = envParent;
-          }
+  server.tool(
+    "slack_search",
+    "Search messages in a connected Slack workspace (needs a user token). Pass team_id from list_teams.",
+    {
+      team_id: z.string(),
+      query: z.string(),
+      count: z.number().optional()
+    },
+    async ({ team_id, query, count }) => {
+      try {
+        const ws = requireSlackWorkspace(team_id);
+        const token = slackTokenFor(ws, "search");
+        const data = await slackApi(token, "search.messages", {
+          query,
+          count: Math.min(50, Math.max(1, count ?? 10)),
+          sort: "timestamp"
+        });
+        return text({
+          team_id: ws.team_id,
+          team_name: ws.team_name,
+          query,
+          matches: (data.messages?.matches ?? []).map((m) => ({
+            channel: m.channel?.name || m.channel?.id,
+            user: m.username || m.user,
+            ts: m.ts,
+            text: m.text,
+            permalink: m.permalink
+          }))
+        });
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+  server.tool(
+    "slack_read",
+    "Read recent messages in a Slack channel or DM, or a thread when ts is set. Pass team_id from list_teams and #channel, @user, or a C\u2026/D\u2026/U\u2026 id.",
+    {
+      team_id: z.string(),
+      channel: z.string(),
+      ts: z.string().optional(),
+      limit: z.number().optional()
+    },
+    async ({ team_id, channel, ts, limit }) => {
+      try {
+        const ws = requireSlackWorkspace(team_id);
+        const token = slackTokenFor(ws, "read");
+        const dest = await resolveSlackDestination(token, channel, { forRead: true });
+        const n = Math.min(100, Math.max(1, limit ?? 20));
+        if (ts?.trim()) {
+          const data2 = await slackApi(token, "conversations.replies", {
+            channel: dest.channelId,
+            ts: ts.trim(),
+            limit: n
+          });
+          return text({
+            team_id: ws.team_id,
+            channel: dest.channelId,
+            label: dest.label,
+            thread_ts: ts.trim(),
+            messages: data2.messages ?? []
+          });
         }
-        if (parentId && !parent) {
-          parentCorrectedFrom = parentId;
-          parentId = "";
-          parent = null;
+        const data = await slackApi(token, "conversations.history", {
+          channel: dest.channelId,
+          limit: n
+        });
+        return text({
+          team_id: ws.team_id,
+          channel: dest.channelId,
+          label: dest.label,
+          messages: data.messages ?? []
+        });
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+  server.tool(
+    "slack_post",
+    "Post a message to a Slack channel or DM (as the Sideboard bot). Pass team_id from list_teams. Use to or channel for #name, @user, or C\u2026/D\u2026/U\u2026 ids. Optional github_url appends a PR / code / comment link. Only notify when the user asks. Thread with thread_ts when set.",
+    {
+      team_id: z.string(),
+      channel: z.string().optional(),
+      to: z.string().optional(),
+      text: z.string(),
+      github_url: z.string().optional(),
+      thread_ts: z.string().optional()
+    },
+    async ({ team_id, channel, to, text: message, github_url, thread_ts }) => {
+      try {
+        const destRaw = (to ?? channel)?.trim();
+        if (!destRaw) {
+          return fail(new Error("slack_post needs `to` or `channel` (#name, @user, or Slack id)"));
         }
-        if (parentId) {
-          const children = orch.getThreads(false).filter((t) => t.parentThreadId === parentId);
-          if (children.length >= MAX_ORCH_THREADS) {
-            return {
-              content: [
-                {
-                  type: "text",
-                  text: `Thread-creation cap (${MAX_ORCH_THREADS}) reached for this orchestration session`
-                }
-              ],
-              isError: true
-            };
+        const ws = requireSlackWorkspace(team_id);
+        const token = slackTokenFor(ws, "write");
+        const dest = await resolveSlackDestination(token, destRaw);
+        const body = appendGithubLink(message, github_url);
+        const data = await slackApi(
+          token,
+          "chat.postMessage",
+          {
+            channel: dest.channelId,
+            text: body,
+            thread_ts: thread_ts?.trim() || void 0,
+            unfurl_links: true,
+            unfurl_media: true
+          }
+        );
+        const postedTs = data.ts?.trim();
+        const postedChannel = (data.channel || dest.channelId).trim();
+        if (postedTs && postedChannel) {
+          try {
+            recordSlackOutboundWatch({
+              teamId: ws.team_id,
+              channelId: postedChannel,
+              ts: postedTs,
+              threadTs: thread_ts?.trim() || postedTs,
+              kind: dest.kind === "channel" ? "channel" : "dm",
+              toUserId: dest.userId,
+              toLabel: dest.label,
+              ownerUserId: ws.user_id
+            });
+          } catch {
           }
         }
-        let agentArg = args.agent;
-        let agentCoercedFrom;
-        const resolvedProbe = resolveNewThreadOptions2({ agent: agentArg }).agent;
-        if (resolvedProbe === "codex") {
-          agentCoercedFrom = agentArg ?? "codex";
-          const accountAgent = resolveNewThreadOptions2({}).agent;
-          agentArg = accountAgent !== "codex" ? accountAgent : "cursor";
-        }
-        const opts = resolveNewThreadOptions2({
-          agent: agentArg,
-          model: args.model
+        return text({
+          ok: true,
+          team_id: ws.team_id,
+          channel: postedChannel,
+          label: dest.label,
+          kind: dest.kind,
+          user_id: dest.userId,
+          ts: postedTs
         });
-        try {
-          const thread = await withTimeout(
-            orch.createThread({
-              sourceType: args.sourceType,
-              sourceRef: args.sourceRef,
-              agent: opts.agent,
-              model: opts.model,
-              effort: opts.effort,
-              fast: opts.fast,
-              repoPath: args.repoPath,
-              title: args.title,
-              parentThreadId: parentId || null
-            }),
-            CREATE_THREAD_TIMEOUT_MS,
-            "create_thread"
-          );
-          const parentNote = parentCorrectedFrom ? parentId ? `Ignored unknown/stale parentThreadId ${parentCorrectedFrom}; nested under ${parentId}` : `Ignored unknown/stale parentThreadId ${parentCorrectedFrom}; created without parent` : void 0;
-          return {
-            content: [
-              {
-                type: "text",
-                text: JSON.stringify({
-                  id: thread.id,
-                  title: thread.title,
-                  branchName: thread.branchName,
-                  worktreePath: thread.worktreePath,
-                  agent: thread.agent,
-                  model: thread.model,
-                  status: thread.status,
-                  link: `sideboard://thread/${thread.id}`,
-                  parentThreadId: thread.parentThreadId,
-                  ...agentCoercedFrom ? {
-                    agentCoercedFrom,
-                    note: `Avoid nested Codex under a Codex orchestrator \u2014 used Account default agent=${thread.agent}`
-                  } : {},
-                  ...parentCorrectedFrom ? { parentCorrectedFrom, parentNote } : {}
-                })
-              }
-            ]
-          };
-        } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
+      } catch (err) {
+        return fail(err);
+      }
+    }
+  );
+}
+
+// src/mcp/server.ts
+var MAX_ORCH_THREADS = 5;
+var CREATE_THREAD_TIMEOUT_MS = 9e4;
+function withTimeout(promise, ms, label) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error(`${label} timed out after ${Math.round(ms / 1e3)}s`));
+    }, ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+async function startMcpServer() {
+  const orch = getOrchestrator();
+  try {
+    const { maxConcurrentAgents: maxConcurrentAgents2 } = await import("./app-settings-3TLA2EJ7.js");
+    orch.setMaxConcurrent(maxConcurrentAgents2());
+  } catch {
+  }
+  try {
+    await orch.reconcile(void 0, { reclaimStaleTurns: false, drainQueues: false });
+  } catch (err) {
+    console.error(
+      "[sideboard-mcp] reconcile on boot failed (continuing):",
+      err instanceof Error ? err.message : err
+    );
+  }
+  const server = new McpServer({
+    name: "sideboard",
+    version: "0.1.0"
+  });
+  server.tool(
+    "list_workspaces",
+    "List registered Sideboard workspaces (repos). Each line is name, path, and github:owner/repo when resolvable \u2014 use path as repoPath for list_branches/list_prs/list_issues/create_thread.",
+    {},
+    async () => {
+      const workspaces = orch.listWorkspaces();
+      const lines = await Promise.all(
+        workspaces.map(async (w) => {
+          const slug = await resolveGithubRepoSlug(w.path).catch(() => null);
+          return slug ? `${w.name}  ${w.path}  github:${slug}` : `${w.name}  ${w.path}`;
+        })
+      );
+      return {
+        content: [
+          { type: "text", text: lines.join("\n") || "(no workspaces)" }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "list_threads",
+    "List Sideboard threads across all workspaces (one summary line each \u2014 token-frugal). Each line ends with sideboard://thread/<id> \u2014 use that URL in markdown links so the UI can open the chat.",
+    {},
+    async () => {
+      const threads = orch.getThreads(true);
+      const lines = threads.map((t) => {
+        const repo = t.repoPath === GLOBAL_WORKSPACE_ID ? "Orchestration" : basename4(t.repoPath) || t.repoPath;
+        return `${t.id.slice(0, 8)}  ${t.status.padEnd(9)}  ${t.agent.padEnd(8)}  ${repo}  ${t.sourceType}:${t.sourceRef}  ${t.title}  sideboard://thread/${t.id}${t.devPort ? `  http://localhost:${t.devPort}` : ""}`;
+      });
+      return {
+        content: [{ type: "text", text: lines.join("\n") || "(no threads)" }]
+      };
+    }
+  );
+  server.tool(
+    "get_thread",
+    "Get a compact thread summary by id/ref",
+    { ref: z2.string() },
+    async ({ ref }) => {
+      const t = orch.getThread(ref);
+      if (!t) {
+        return { content: [{ type: "text", text: `Thread not found: ${ref}` }], isError: true };
+      }
+      const summary = {
+        id: t.id,
+        title: t.title,
+        status: t.status,
+        agent: t.agent,
+        sourceType: t.sourceType,
+        sourceRef: t.sourceRef,
+        branchName: t.branchName,
+        worktreePath: t.worktreePath,
+        sessionId: t.sessionId,
+        queueLength: t.queue.length,
+        messageCount: t.messages.length,
+        devPort: t.devPort,
+        prUrl: t.prUrl,
+        lastError: t.lastError ?? null
+      };
+      return { content: [{ type: "text", text: JSON.stringify(summary, null, 2) }] };
+    }
+  );
+  server.tool(
+    "present_artifact",
+    "Show an HTML, SVG, markdown, or React document in Sideboard\u2019s Claude-style side column (desktop). Use instead of claude.ai\u2019s artifact tool \u2014 pass the full document content. Prefer type=html for interactive pages. For type=react, pass a single component module that `export default`s a component (JSX/TSX ok) \u2014 Sideboard bootstraps React/ReactDOM/Babel and renders it; only `react`/`react-dom` imports are available, no other npm packages.",
+    {
+      title: z2.string().describe("Short title shown in the artifact pane header"),
+      type: z2.enum(["html", "svg", "markdown", "react"]).describe(
+        "Artifact kind \u2014 html opens an iframe preview; react transpiles and renders a default-exported component in a sandboxed iframe"
+      ),
+      content: z2.string().describe(
+        "Full document body (complete HTML page, SVG markup, markdown, or a React component module with a default export)"
+      ),
+      artifact_id: z2.string().optional().describe("Stable id when updating the same artifact across turns")
+    },
+    async ({ title, type, artifact_id }) => {
+      const id = artifact_id?.trim() || `artifact_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+      const payload = {
+        ok: true,
+        artifact_id: id,
+        title,
+        type,
+        message: "Artifact accepted. Sideboard desktop opens it in the side column beside chat."
+      };
+      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
+    }
+  );
+  server.tool(
+    "ask_user",
+    "Ask the user clarifying multiple-choice questions in Sideboard\u2019s composer (plan mode). Before calling, write a short chat message explaining the decision and what each option means. Include a description on every option. Use for approach forks and requirements \u2014 not for \u201Cis the plan ready?\u201D. After calling, stop and wait for their next message with answers.",
+    {
+      questions: z2.array(
+        z2.object({
+          question: z2.string().describe("Full question text ending with ?"),
+          header: z2.string().max(24).optional().describe("Short label shown above the question"),
+          multiSelect: z2.boolean().optional().describe("Allow selecting multiple options"),
+          options: z2.array(
+            z2.object({
+              label: z2.string(),
+              description: z2.string().optional().describe("What this option means / when to choose it (strongly preferred)")
+            })
+          ).min(2).max(6).describe("2\u20136 choices (Sideboard also offers Other)")
+        })
+      ).min(1).max(4).describe("1\u20134 questions")
+    },
+    async ({ questions }) => {
+      const payload = {
+        ok: true,
+        questions,
+        message: "Questions shown in Sideboard\u2019s composer. Wait for the user\u2019s next message with their answers before continuing."
+      };
+      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
+    }
+  );
+  server.tool(
+    "present_plan",
+    "Save the implementation plan as markdown to .context/attachments/plan.md and show it in Sideboard chat for user approval (Copy / Hand off / Approve). Call this when the plan is ready \u2014 required in plan mode. Pass the full plan body in content. Then Claude should call ExitPlanMode.",
+    {
+      title: z2.string().optional().describe("Short plan title (defaults to Plan)"),
+      content: z2.string().min(1).describe("Full plan markdown (headings, steps, risks, open questions)"),
+      thread_id: z2.string().optional().describe("Sideboard thread id when cwd is not the worktree")
+    },
+    async ({ title, content, thread_id }) => {
+      const { writePlanFile: writePlanFile2 } = await import("./plan-file-6O7G4VPQ.js");
+      let root = process.cwd();
+      if (thread_id?.trim()) {
+        const t = orch.getThread(thread_id.trim());
+        if (t?.worktreePath?.trim()) root = t.worktreePath;
+      }
+      const path = writePlanFile2(root, content);
+      const payload = {
+        ok: true,
+        path,
+        title: title?.trim() || "Plan",
+        message: "Plan saved to .context/attachments/plan.md and shown in Sideboard chat for approval."
+      };
+      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
+    }
+  );
+  server.tool(
+    "present_schema",
+    "Open Sideboard\u2019s schema-driven side column (filterable table and/or form). Pass JSON Schema + optional schemaUi. Prefer datasource=inline with embedded resource/records. Use datasource=brightsy with resource_id only when the user is logged into Brightsy.",
+    {
+      title: z2.string().describe("Pane title"),
+      mode: z2.enum(["table", "form"]).optional().describe("table = list/filter records; form = edit one record"),
+      datasource: z2.enum(["brightsy", "inline"]).optional().describe("brightsy resolves via login; inline uses embedded resource/records"),
+      resource_id: z2.string().optional().describe("Brightsy record type UUID (or generic resource id)"),
+      record_id: z2.string().optional().describe("Record id when opening form mode"),
+      resource: z2.record(z2.unknown()).optional().describe("Inline { id, title, schema, schemaUi?, slug? }"),
+      record: z2.record(z2.unknown()).optional().describe("Inline record { id, data, published_at? }"),
+      records: z2.array(z2.record(z2.unknown())).optional().describe("Inline records for table mode"),
+      pane_id: z2.string().optional().describe("Stable pane id across updates")
+    },
+    async (args) => {
+      const id = args.pane_id?.trim() || `schema_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+      const payload = {
+        ok: true,
+        pane_id: id,
+        title: args.title,
+        mode: args.mode ?? (args.record_id || args.record ? "form" : "table"),
+        datasource: args.datasource ?? (args.resource ? "inline" : "brightsy"),
+        resource_id: args.resource_id,
+        record_id: args.record_id,
+        message: "Schema pane accepted. Sideboard desktop opens the CMS column beside chat."
+      };
+      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
+    }
+  );
+  server.tool(
+    "present_files",
+    "Open Sideboard\u2019s Files column (CMS-style file manager: browse, upload, pick). Use datasource=brightsy when the user is logged into Brightsy account storage; datasource=memory for a session-local demo store. Prefer this over claiming a file manager UI is unavailable. Pair with present_schema when editing records that need media.",
+    {
+      title: z2.string().optional().describe("Pane title (default: Files)"),
+      datasource: z2.enum(["brightsy", "memory"]).optional().describe("brightsy = account storage via login; memory = session demo store"),
+      path: z2.string().optional().describe("Initial folder path (e.g. public)"),
+      pane_id: z2.string().optional().describe("Stable pane id across updates")
+    },
+    async (args) => {
+      const id = args.pane_id?.trim() || `files_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+      const payload = {
+        ok: true,
+        pane_id: id,
+        title: args.title?.trim() || "Files",
+        datasource: args.datasource ?? "brightsy",
+        path: args.path,
+        message: "Files pane accepted. Sideboard desktop opens the Files column beside chat."
+      };
+      return { content: [{ type: "text", text: JSON.stringify(payload) }] };
+    }
+  );
+  registerSlackTools(server);
+  if (sideboardMcpProfile() !== "worktree") {
+    const { getCaffeinateHold: getCaffeinateHold2, setCaffeinateHold: setCaffeinateHold2 } = await import("./caffeinate-hold-KLC6SABD.js");
+    const { resolveNewThreadOptions: resolveNewThreadOptions2, resolveThreadDefaults: resolveThreadDefaults2 } = await import("./app-settings-3TLA2EJ7.js");
+    const accountDefaults = resolveThreadDefaults2();
+    const accountDefaultsHint = `Account defaults: agent=${accountDefaults.agent}, model=${accountDefaults.model?.trim() || "Auto"}, effort=${accountDefaults.effort}`;
+    server.tool(
+      "set_caffeinate",
+      "Keep this Mac awake with caffeinate (like Claude Code) across turns \u2014 independent of Settings toggles. Turn ON when the user will be away from the keyboard, is driving work from Slack, or asks you to keep the machine awake. Turn OFF when they say they are done, wrapping up, going to sleep, or no longer need the Mac awake. macOS only.",
+      {
+        enabled: z2.boolean().describe("true = hold caffeinate on; false = release and let the Mac sleep")
+      },
+      async ({ enabled }) => {
+        const state = setCaffeinateHold2(enabled);
+        if (enabled && !state.held) {
           return {
             content: [
               {
                 type: "text",
-                text: `create_thread failed: ${message}`
+                text: JSON.stringify({
+                  ...state,
+                  ok: false,
+                  message: state.platform === "darwin" ? "Could not start caffeinate." : "Caffeinate is macOS only."
+                })
               }
             ],
             isError: true
           };
         }
-      }
-    );
-    server.tool(
-      "send_to_thread",
-      "Queue a prompt on a worktree thread chat (runs under concurrency cap). Use after create_thread to start or continue a conversation. Set force_stop=true to interrupt an in-flight/queued turn (kill + clear queue) before queueing this prompt \u2014 use when the thread is mid-turn or has stale queued prompts you need to replace.",
-      {
-        ref: z.string(),
-        prompt: z.string(),
-        force_stop: z.boolean().optional()
-      },
-      async ({ ref, prompt, force_stop }) => {
-        if (force_stop) {
-          const existing = orch.getThread(ref);
-          if (existing) {
-            orch.stop(ref, { clearQueue: true });
-          }
-        }
-        const thread = await orch.send(ref, prompt);
         return {
           content: [
             {
               type: "text",
               text: JSON.stringify({
-                id: thread.id,
-                status: thread.status,
-                queueLength: thread.queue.length,
-                forceStopped: Boolean(force_stop)
+                ...getCaffeinateHold2(),
+                ok: true,
+                message: state.held ? "Mac will stay awake until you call set_caffeinate with enabled=false (or the user says they are done)." : "Caffeinate hold released. The Mac can sleep (unless Settings caffeinate toggles are on)."
               })
             }
           ]
@@ -6709,16 +7760,162 @@ async function startMcpServer() {
       }
     );
     server.tool(
-      "wait_for_turn",
-      "Block until the thread finishes its current/queued turn (avoids polling). Use after send_to_thread to read the agent reply.",
+      "create_thread",
+      `Create a new worktree thread (chat) from branch, pr, or ticket. Pass repoPath from list_workspaces. From an orchestration chat, omit parentThreadId (Sideboard binds the child to this chat) or pass the exact id from the turn reminder \u2014 never invent a uuid. Prefer omitting agent/model so Sideboard applies ${accountDefaultsHint}. Then use send_to_thread to chat.`,
       {
-        ref: z.string(),
-        timeoutMs: z.number().optional()
+        sourceType: z2.enum(["branch", "pr", "ticket"]),
+        sourceRef: z2.string(),
+        agent: z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"]).optional().describe(`Omit to use Account default agent (${accountDefaults.agent})`),
+        model: z2.string().nullable().optional().describe(
+          `Usually omit to use Account default model (${accountDefaults.model?.trim() || "Auto"}). Pass null only to force Auto / agent-default.`
+        ),
+        repoPath: z2.string(),
+        title: z2.string().optional(),
+        parentThreadId: z2.string().optional().describe(
+          "Orchestration: omit (preferred) or pass YOUR chat id from the turn reminder / AGENTS.md. Do not invent uuids."
+        )
       },
-      async ({ ref, timeoutMs }) => {
-        const thread = await orch.waitForTurn(ref, timeoutMs ?? 6e5);
-        const result = orch.getTurnResult(thread.id);
-        return {
+      async (args) => {
+        const envParentId = process.env.SIDEBOARD_ORCHESTRATOR_THREAD_ID?.trim() || "";
+        let parentId = args.parentThreadId?.trim() || "";
+        let parent = parentId ? orch.getThread(parentId) : null;
+        let parentCorrectedFrom;
+        if (envParentId) {
+          const envParent = orch.getThread(envParentId);
+          if (envParent) {
+            if (parentId && parentId !== envParentId) parentCorrectedFrom = parentId;
+            else if (!parentId) parentCorrectedFrom = void 0;
+            parentId = envParentId;
+            parent = envParent;
+          }
+        }
+        if (parentId && !parent) {
+          parentCorrectedFrom = parentId;
+          parentId = "";
+          parent = null;
+        }
+        if (parentId) {
+          const children = orch.getThreads(false).filter((t) => t.parentThreadId === parentId);
+          if (children.length >= MAX_ORCH_THREADS) {
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `Thread-creation cap (${MAX_ORCH_THREADS}) reached for this orchestration session`
+                }
+              ],
+              isError: true
+            };
+          }
+        }
+        let agentArg = args.agent;
+        let agentCoercedFrom;
+        const resolvedProbe = resolveNewThreadOptions2({ agent: agentArg }).agent;
+        if (resolvedProbe === "codex") {
+          agentCoercedFrom = agentArg ?? "codex";
+          const accountAgent = resolveNewThreadOptions2({}).agent;
+          agentArg = accountAgent !== "codex" ? accountAgent : "cursor";
+        }
+        const opts = resolveNewThreadOptions2({
+          agent: agentArg,
+          model: args.model
+        });
+        try {
+          const thread = await withTimeout(
+            orch.createThread({
+              sourceType: args.sourceType,
+              sourceRef: args.sourceRef,
+              agent: opts.agent,
+              model: opts.model,
+              effort: opts.effort,
+              fast: opts.fast,
+              repoPath: args.repoPath,
+              title: args.title,
+              parentThreadId: parentId || null
+            }),
+            CREATE_THREAD_TIMEOUT_MS,
+            "create_thread"
+          );
+          const parentNote = parentCorrectedFrom ? parentId ? `Ignored unknown/stale parentThreadId ${parentCorrectedFrom}; nested under ${parentId}` : `Ignored unknown/stale parentThreadId ${parentCorrectedFrom}; created without parent` : void 0;
+          return {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  id: thread.id,
+                  title: thread.title,
+                  branchName: thread.branchName,
+                  worktreePath: thread.worktreePath,
+                  agent: thread.agent,
+                  model: thread.model,
+                  status: thread.status,
+                  link: `sideboard://thread/${thread.id}`,
+                  parentThreadId: thread.parentThreadId,
+                  ...agentCoercedFrom ? {
+                    agentCoercedFrom,
+                    note: `Avoid nested Codex under a Codex orchestrator \u2014 used Account default agent=${thread.agent}`
+                  } : {},
+                  ...parentCorrectedFrom ? { parentCorrectedFrom, parentNote } : {}
+                })
+              }
+            ]
+          };
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          return {
+            content: [
+              {
+                type: "text",
+                text: `create_thread failed: ${message}`
+              }
+            ],
+            isError: true
+          };
+        }
+      }
+    );
+    server.tool(
+      "send_to_thread",
+      "Queue a prompt on a worktree thread chat (runs under concurrency cap). Use after create_thread to start or continue a conversation. Set force_stop=true to interrupt an in-flight/queued turn (kill + clear queue) before queueing this prompt \u2014 use when the thread is mid-turn or has stale queued prompts you need to replace.",
+      {
+        ref: z2.string(),
+        prompt: z2.string(),
+        force_stop: z2.boolean().optional()
+      },
+      async ({ ref, prompt, force_stop }) => {
+        if (force_stop) {
+          const existing = orch.getThread(ref);
+          if (existing) {
+            orch.stop(ref, { clearQueue: true });
+          }
+        }
+        const thread = await orch.send(ref, prompt);
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                id: thread.id,
+                status: thread.status,
+                queueLength: thread.queue.length,
+                forceStopped: Boolean(force_stop)
+              })
+            }
+          ]
+        };
+      }
+    );
+    server.tool(
+      "wait_for_turn",
+      "Block until the thread finishes its current/queued turn (avoids polling). Use after send_to_thread to read the agent reply.",
+      {
+        ref: z2.string(),
+        timeoutMs: z2.number().optional()
+      },
+      async ({ ref, timeoutMs }) => {
+        const thread = await orch.waitForTurn(ref, timeoutMs ?? 6e5);
+        const result = orch.getTurnResult(thread.id);
+        return {
           content: [
             {
               type: "text",
@@ -6735,7 +7932,7 @@ async function startMcpServer() {
     server.tool(
       "get_turn_result",
       "Final assistant message only (not full transcript)",
-      { ref: z.string() },
+      { ref: z2.string() },
       async ({ ref }) => {
         const result = orch.getTurnResult(ref);
         return { content: [{ type: "text", text: JSON.stringify(result) }] };
@@ -6745,8 +7942,8 @@ async function startMcpServer() {
       "stop_thread",
       "Force-stop a thread: kill any in-flight agent turn AND clear queued prompts so drainQueue cannot continue. Does not archive the worktree. Optional force defaults to true.",
       {
-        ref: z.string(),
-        force: z.boolean().optional()
+        ref: z2.string(),
+        force: z2.boolean().optional()
       },
       async ({ ref, force }) => {
         const t = orch.getThread(ref);
@@ -6775,8 +7972,8 @@ async function startMcpServer() {
     );
     server.tool(
       "archive_thread",
-      "Archive a thread (stops agent/dev, runs archive script, removes worktree when last chat tab). Cannot archive the cloud coordinator \u2014 use the Sideboard UI for that.",
-      { ref: z.string() },
+      "Archive a thread (stops agent/dev, runs archive script, removes worktree when last chat tab). Coordinators open PRs only by asking the worktree agent.",
+      { ref: z2.string() },
       async ({ ref }) => {
         const t = orch.getThread(ref);
         if (!t) {
@@ -6809,7 +8006,7 @@ async function startMcpServer() {
     server.tool(
       "restore_thread",
       "Restore an archived thread (recreates worktree from branch when needed)",
-      { ref: z.string() },
+      { ref: z2.string() },
       async ({ ref }) => {
         try {
           const restored = await orch.restore(ref);
@@ -6835,8 +8032,8 @@ async function startMcpServer() {
       "get_diff",
       "Compact diff summary (capped hunks, paginated)",
       {
-        ref: z.string(),
-        maxFiles: z.number().optional()
+        ref: z2.string(),
+        maxFiles: z2.number().optional()
       },
       async ({ ref, maxFiles }) => {
         const summary = await orch.diffSummary(ref);
@@ -6856,7 +8053,7 @@ async function startMcpServer() {
     server.tool(
       "request_review",
       'Start a merge-readiness Review on a worktree agent thread (same as the desktop Review button). Opens a new Review chat tab, attaches .sideboard/review.md when present (else local Review request.md / stock template), and sends "Review changes in this workspace." Expect Approve / Approve with nits / Request changes / Needs more information. Pass a worktree thread ref \u2014 not the orchestrator. Then wait_for_turn / get_turn_result on the returned review tab id.',
-      { ref: z.string().describe("Worktree thread id/ref to review") },
+      { ref: z2.string().describe("Worktree thread id/ref to review") },
       async ({ ref }) => {
         try {
           const tab = await orch.requestReview(ref);
@@ -6881,7 +8078,7 @@ async function startMcpServer() {
         }
       }
     );
-    const agentEnum = z.enum(["claude", "codex", "opencode", "brightsy", "cursor"]);
+    const agentEnum = z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"]);
     server.tool(
       "list_models",
       "List models for an agent. Prefer Auto: do not call this unless you have a reason to pin a specific model (user request, cost/latency, capability). Omit agent to list all.",
@@ -6904,11 +8101,11 @@ async function startMcpServer() {
       "fork_worktree",
       "Fork a worktree agent chat into a NEW git worktree + chat (desktop \u201CFork to new workspace\u201D). Seeds a transcript (through through_index, default all). Optional agent override. Leave model unset for Auto (default) \u2014 only pass model when you have a reason. Not for the orchestrator. Then send_to_thread / wait_for_turn on the returned id.",
       {
-        ref: z.string().describe("Worktree thread id/ref to fork"),
-        through_index: z.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
+        ref: z2.string().describe("Worktree thread id/ref to fork"),
+        through_index: z2.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
         agent: agentEnum.optional().describe("Agent for the forked chat (default: same as source)"),
-        model: z.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
-        title: z.string().optional()
+        model: z2.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
+        title: z2.string().optional()
       },
       async ({ ref, through_index, agent, model, title }) => {
         try {
@@ -6947,13 +8144,13 @@ async function startMcpServer() {
     );
     server.tool(
       "fork_chat",
-      "Fork a chat into a NEW tab on the SAME workspace: worktree agent \u2192 same worktree tab; Global orchestration chat \u2192 new orchestration chat (same synthetic home). Seeds a transcript; optional agent override. Leave model unset for Auto unless you have a reason. Orchestration forks require an MCP-capable agent (claude, cursor, codex, opencode \u2014 not brightsy). Remote coordinators use this to continue an orchestration chat on another agent after session limits. Then send_to_thread / wait_for_turn on the returned id. Use fork_worktree only for worktree agents that need a new git worktree.",
+      "Fork a chat into a NEW tab on the SAME workspace: worktree agent \u2192 same worktree tab; Global orchestration chat \u2192 new orchestration chat (same synthetic home). Seeds a transcript; optional agent override. Leave model unset for Auto unless you have a reason. Orchestration forks require an MCP-capable agent (claude, cursor, codex, opencode \u2014 not brightsy). Slack / Global orchestrators use this to continue an orchestration chat on another agent after session limits. Then send_to_thread / wait_for_turn on the returned id. Use fork_worktree only for worktree agents that need a new git worktree.",
       {
-        ref: z.string().describe("Thread id/ref to fork (worktree agent or orchestration chat)"),
-        through_index: z.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
+        ref: z2.string().describe("Thread id/ref to fork (worktree agent or orchestration chat)"),
+        through_index: z2.number().optional().describe("Inclusive message index to include in the transcript (default: all)"),
         agent: agentEnum.optional().describe("Agent for the forked chat (default: same as source)"),
-        model: z.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
-        title: z.string().optional()
+        model: z2.string().nullable().optional().describe("Usually omit (Auto). Only set from list_models when you need a specific model"),
+        title: z2.string().optional()
       },
       async ({ ref, through_index, agent, model, title }) => {
         try {
@@ -6999,8 +8196,8 @@ async function startMcpServer() {
       "run_dev_script",
       "Start a .sideboard/.conductor run script for a thread (default script if name omitted); returns port",
       {
-        ref: z.string(),
-        name: z.string().optional()
+        ref: z2.string(),
+        name: z2.string().optional()
       },
       async ({ ref, name }) => {
         const result = await orch.startDev(ref, name);
@@ -7022,7 +8219,7 @@ async function startMcpServer() {
     server.tool(
       "list_run_scripts",
       "List named run scripts available for a thread",
-      { ref: z.string() },
+      { ref: z2.string() },
       async ({ ref }) => {
         const scripts = orch.listThreadRunScripts(ref);
         const active = orch.getActiveRuns(ref);
@@ -7040,8 +8237,8 @@ async function startMcpServer() {
       "stop_dev_script",
       "Stop a running script for a thread (all scripts if name omitted)",
       {
-        ref: z.string(),
-        name: z.string().optional()
+        ref: z2.string(),
+        name: z2.string().optional()
       },
       async ({ ref, name }) => {
         orch.stopDev(ref, name);
@@ -7051,7 +8248,7 @@ async function startMcpServer() {
     server.tool(
       "run_setup",
       "Re-run workspace setup (Sideboard/Conductor settings or .cursor/worktrees.json)",
-      { ref: z.string() },
+      { ref: z2.string() },
       async ({ ref }) => {
         const result = await orch.runSetup(ref);
         return {
@@ -7062,7 +8259,7 @@ async function startMcpServer() {
     server.tool(
       "add_workspace",
       "Register a git repo as a Sideboard workspace",
-      { repoPath: z.string() },
+      { repoPath: z2.string() },
       async ({ repoPath }) => {
         const ws = await orch.addWorkspace(repoPath);
         return { content: [{ type: "text", text: JSON.stringify(ws) }] };
@@ -7071,7 +8268,7 @@ async function startMcpServer() {
     server.tool(
       "remove_workspace",
       "Unregister a Sideboard workspace (does not archive threads)",
-      { repoPath: z.string() },
+      { repoPath: z2.string() },
       async ({ repoPath }) => {
         orch.removeWorkspace(repoPath);
         return { content: [{ type: "text", text: "ok" }] };
@@ -7081,12 +8278,12 @@ async function startMcpServer() {
       "fanout",
       "Best-of-n: create one thread per agent with the same prompt (parallel attempts)",
       {
-        prompt: z.string(),
-        agents: z.array(z.enum(["claude", "codex", "opencode", "brightsy", "cursor"])),
-        repoPath: z.string(),
-        sourceType: z.enum(["branch", "pr", "ticket"]).optional(),
-        sourceRef: z.string().optional(),
-        title: z.string().optional()
+        prompt: z2.string(),
+        agents: z2.array(z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"])),
+        repoPath: z2.string(),
+        sourceType: z2.enum(["branch", "pr", "ticket"]).optional(),
+        sourceRef: z2.string().optional(),
+        title: z2.string().optional()
       },
       async (args) => {
         const threads = await orch.bestOfN(args);
@@ -7113,8 +8310,8 @@ async function startMcpServer() {
       "list_branches",
       "List git branches in a registered workspace. Pass repoPath from list_workspaces (unmerged into the default branch by default \u2014 for create_thread sourceType=branch).",
       {
-        repoPath: z.string(),
-        unmergedOnly: z.boolean().optional()
+        repoPath: z2.string(),
+        unmergedOnly: z2.boolean().optional()
       },
       async ({ repoPath, unmergedOnly }) => {
         const root = await resolveRepoRoot(repoPath);
@@ -7134,7 +8331,7 @@ async function startMcpServer() {
     server.tool(
       "list_prs",
       "List open GitHub PRs for a registered workspace. Pass repoPath from list_workspaces (uses gh against that repo remote). Then create_thread with sourceType=pr.",
-      { repoPath: z.string() },
+      { repoPath: z2.string() },
       async ({ repoPath }) => {
         const root = await resolveRepoRoot(repoPath);
         const prs = await listPrs(root);
@@ -7153,7 +8350,7 @@ async function startMcpServer() {
     server.tool(
       "get_pr_stack",
       "Load the GitHub PR stack for a thread worktree (`gh stack view --json`). Returns null JSON when the branch is not stacked. Prefer this before mergePr on stacked PRs.",
-      { ref: z.string() },
+      { ref: z2.string() },
       async ({ ref }) => {
         const stack = await orch.getPrStack(ref);
         return {
@@ -7165,8 +8362,8 @@ async function startMcpServer() {
       "open_pr_stack_layers",
       "Materialize one worktree+thread per stack layer (or a single 1-based layer). Pass a thread ref already on the stack.",
       {
-        ref: z.string(),
-        layer: z.number().int().positive().optional()
+        ref: z2.string(),
+        layer: z2.number().int().positive().optional()
       },
       async ({ ref, layer }) => {
         const result = await orch.openPrStackLayers(ref, { layer });
@@ -7200,9 +8397,9 @@ async function startMcpServer() {
       "add_stack_layer",
       "Add a branch on top of the current stack (`gh stack add`) and open a worktree+thread for it.",
       {
-        ref: z.string(),
-        branchName: z.string(),
-        title: z.string().optional()
+        ref: z2.string(),
+        branchName: z2.string(),
+        title: z2.string().optional()
       },
       async ({ ref, branchName, title }) => {
         const result = await orch.addStackLayer(ref, branchName, { title });
@@ -7231,11 +8428,11 @@ async function startMcpServer() {
       "create_pr_stack",
       "Create a new GitHub PR stack with one Sideboard worktree per layer (bottom\u2192top branch names). Requires `gh extension install github/gh-stack`.",
       {
-        repoPath: z.string(),
-        branches: z.array(z.string()).min(1),
-        agent: z.enum(["claude", "codex", "opencode", "brightsy", "cursor"]),
-        base: z.string().optional(),
-        title: z.string().optional()
+        repoPath: z2.string(),
+        branches: z2.array(z2.string()).min(1),
+        agent: z2.enum(["claude", "codex", "opencode", "brightsy", "cursor"]),
+        base: z2.string().optional(),
+        title: z2.string().optional()
       },
       async (args) => {
         const result = await orch.createPrStack({
@@ -7269,362 +8466,1640 @@ async function startMcpServer() {
           ]
         };
       }
-    );
-    server.tool(
-      "list_issues",
-      "List issues from Sideboard Account connections (Linear API or GitHub Issues; Linear\u2192GitHub fallback when Linear is not connected). Pass repoPath from list_workspaces \u2014 GitHub Issues are scoped to that repo. Then create_thread with sourceType=ticket.",
-      { repoPath: z.string() },
-      async ({ repoPath }) => {
-        const root = await resolveRepoRoot(repoPath);
-        const result = await listIssues(root);
-        return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    );
+    server.tool(
+      "list_issues",
+      "List issues from Sideboard Account connections (Linear API or GitHub Issues; Linear\u2192GitHub fallback when Linear is not connected). Pass repoPath from list_workspaces \u2014 GitHub Issues are scoped to that repo. Then create_thread with sourceType=ticket.",
+      { repoPath: z2.string() },
+      async ({ repoPath }) => {
+        const root = await resolveRepoRoot(repoPath);
+        const result = await listIssues(root);
+        return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+      }
+    );
+    server.tool(
+      "list_linear_issues",
+      "Deprecated: prefer list_issues. Lists assigned Linear issues via the chosen agent MCP connector",
+      {
+        agent: z2.enum(["claude", "codex", "opencode"]),
+        repoPath: z2.string()
+      },
+      async ({ agent, repoPath }) => {
+        const issues = await listLinearIssues(agent, repoPath);
+        return { content: [{ type: "text", text: JSON.stringify(issues, null, 2) }] };
+      }
+    );
+  }
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+
+// src/brightsy/api.ts
+function formatBrightsyFetchError(err, url) {
+  if (!(err instanceof Error)) return `${String(err)} (${url})`;
+  const cause = err.cause;
+  let detail = "";
+  if (cause instanceof Error) {
+    const code = typeof cause.code === "string" ? cause.code : void 0;
+    detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
+  } else if (cause != null) {
+    detail = ` [${String(cause)}]`;
+  }
+  return `${err.message}${detail} (${url})`;
+}
+var BrightsySideboardApi = class {
+  cfg;
+  fetchImpl;
+  constructor(cfgOrOpts) {
+    const isOpts = !!cfgOrOpts && typeof cfgOrOpts === "object" && ("fetchImpl" in cfgOrOpts || "cfg" in cfgOrOpts) && !("access_token" in cfgOrOpts);
+    if (isOpts) {
+      const opts = cfgOrOpts;
+      this.cfg = opts.cfg ?? loadBrightsyConfig();
+      this.fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
+    } else {
+      this.cfg = cfgOrOpts ?? loadBrightsyConfig();
+      this.fetchImpl = globalThis.fetch.bind(globalThis);
+    }
+  }
+  get accountId() {
+    return this.cfg.account_id;
+  }
+  get endpoint() {
+    return (this.cfg.endpoint || "https://brightsy.ai").replace(/\/$/, "");
+  }
+  async request(path, init = {}) {
+    await this.refreshIfNeeded();
+    const url = `${this.endpoint}${path}`;
+    const headers = {
+      Authorization: `Bearer ${this.cfg.access_token}`,
+      Accept: "application/json"
+    };
+    if (init.body != null) headers["Content-Type"] = "application/json";
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: init.method ?? "GET",
+        headers,
+        body: init.body != null ? JSON.stringify(init.body) : void 0
+      });
+    } catch (err) {
+      throw new Error(formatBrightsyFetchError(err, url));
+    }
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      throw new Error(err.error?.message ?? `${res.status} ${res.statusText} (${url})`);
+    }
+    return await res.json();
+  }
+  async refreshIfNeeded() {
+    const expiresAt = this.cfg.expires_at ?? 0;
+    if (!this.cfg.refresh_token || Date.now() < expiresAt - 6e4) return;
+    const clientId = this.cfg.oauth_client_id || "brightsy-cli";
+    const url = `${this.endpoint}/oauth/token`;
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: this.cfg.refresh_token,
+          client_id: clientId
+        })
+      });
+    } catch (err) {
+      throw new Error(formatBrightsyFetchError(err, url));
+    }
+    if (!res.ok) return;
+    const data = await res.json();
+    if (!data.access_token) return;
+    this.cfg.access_token = data.access_token;
+    if (data.refresh_token) this.cfg.refresh_token = data.refresh_token;
+    if (data.expires_in) {
+      this.cfg.expires_at = Date.now() + data.expires_in * 1e3;
+    }
+    saveBrightsyConfig(this.cfg);
+  }
+  async getAccess() {
+    return this.request(
+      `/api/v1beta/desktop/access?accountId=${encodeURIComponent(this.accountId)}`
+    );
+  }
+  async setAccess(enabled, allow_always = false) {
+    return this.request("/api/v1beta/desktop/access", {
+      method: "PUT",
+      body: {
+        accountId: this.accountId,
+        enabled,
+        allow_always
+      }
+    });
+  }
+  async getTasks(status) {
+    const params = new URLSearchParams();
+    if (status) params.set("status", status);
+    params.set("accountId", this.accountId);
+    const q = `?${params.toString()}`;
+    const data = await this.request(
+      `/api/v1beta/desktop/tasks${q}`
+    );
+    return data.tasks ?? [];
+  }
+  async approveTask(taskId) {
+    await this.request(`/api/v1beta/desktop/tasks/${taskId}`, {
+      method: "PATCH",
+      body: { action: "approve" }
+    });
+  }
+  async markRunning(taskId) {
+    await this.request(`/api/v1beta/desktop/tasks/${taskId}`, {
+      method: "PATCH",
+      body: { task_status: "running" }
+    });
+  }
+  async submitResponse(taskId, response) {
+    await this.request(`/api/v1beta/desktop/tasks/${taskId}/response`, {
+      method: "POST",
+      body: { response }
+    });
+  }
+};
+function taskMessageText(task) {
+  const parts = task.message?.parts ?? [];
+  const text2 = parts.find((p) => p.kind === "text")?.text ?? "";
+  return text2.trim();
+}
+
+// src/brightsy/cloud-connect.ts
+var POLL_MS = 5e3;
+var handleTaskChain = Promise.resolve();
+function enqueueHandleTask(fn) {
+  const run2 = handleTaskChain.then(fn, fn);
+  handleTaskChain = run2.then(
+    () => void 0,
+    () => void 0
+  );
+  return run2;
+}
+function refreshWorkspaces() {
+  const orch = getOrchestrator();
+  return orch.listWorkspaces();
+}
+async function handleTask(api, task, opts) {
+  const log = opts.onLog ?? (() => void 0);
+  let message = taskMessageText(task);
+  if (!message) {
+    log(`skip ${task.id.slice(0, 8)}: empty message`);
+    return;
+  }
+  if (task.task_status !== "pending" && task.task_status !== "running" && task.task_status !== "awaiting_confirmation") {
+    return;
+  }
+  const workspaces = refreshWorkspaces();
+  for (const ws of workspaces) {
+    await getOrchestrator().reconcile(ws.path).catch(() => void 0);
+  }
+  const inventory = await enrichWorkspacesWithGithub(workspaces);
+  const coordinator = ensureCloudCoordinator(opts.agent);
+  let fresh = readThread(coordinator.id) ?? coordinator;
+  const parsed = parseForceStopMessage(message);
+  if (parsed.forceStop) {
+    try {
+      getOrchestrator().stop(fresh.id);
+      log(`force-stop ${task.id.slice(0, 8)} \u2192 coordinator ${fresh.id.slice(0, 8)}`);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      log(`force-stop ${task.id.slice(0, 8)}: ${msg}`);
+    }
+    if (!parsed.remainder) {
+      if (task.task_status === "awaiting_confirmation") {
+        await api.approveTask(task.id).catch(() => void 0);
+      }
+      await api.markRunning(task.id).catch(() => void 0);
+      await api.submitResponse(task.id, CLOUD_COORDINATOR_STOPPED_REPLY);
+      log(`replied stopped ${task.id.slice(0, 8)}`);
+      return;
+    }
+    message = parsed.remainder;
+    fresh = readThread(coordinator.id) ?? ensureCloudCoordinator(opts.agent);
+  }
+  if (fresh.status === "running" || fresh.status === "queued") {
+    log(
+      `busy ${task.id.slice(0, 8)} \u2192 coordinator ${fresh.id.slice(0, 8)} (${fresh.status})`
+    );
+    if (task.task_status === "awaiting_confirmation") {
+      await api.approveTask(task.id).catch(() => void 0);
+    }
+    await api.markRunning(task.id).catch(() => void 0);
+    await api.submitResponse(task.id, CLOUD_COORDINATOR_BUSY_REPLY);
+    log(`replied busy ${task.id.slice(0, 8)}`);
+    return;
+  }
+  if (task.task_status === "awaiting_confirmation") {
+    log(`approve ${task.id.slice(0, 8)}`);
+    await api.approveTask(task.id);
+    task = { ...task, task_status: "pending" };
+  }
+  log(
+    `run ${task.id.slice(0, 8)} \u2192 coordinator ${fresh.id.slice(0, 8)} (${inventory.length} workspace${inventory.length === 1 ? "" : "s"})`
+  );
+  await api.markRunning(task.id).catch(() => void 0);
+  const orch = getOrchestrator();
+  const prompt = [
+    coordinatorSystemPrompt({
+      goal: fresh.sourceRef || CLOUD_ORCHESTRATOR_GOAL,
+      parentId: fresh.id,
+      workspaces: inventory,
+      audience: "cloud"
+    }),
+    "",
+    "--- Cloud agent request ---",
+    message
+  ].join("\n");
+  try {
+    await orch.send(fresh.id, prompt);
+    await orch.waitForTurn(fresh.id, 14 * 60 * 1e3);
+    const result = orch.getTurnResult(fresh.id);
+    const reply = result.text.trim() || `(coordinator finished with status ${result.status}, no text)`;
+    await api.submitResponse(task.id, reply);
+    log(`replied ${task.id.slice(0, 8)} (${reply.length} chars)`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const timedOut = /timed out|timeout/i.test(msg);
+    const reply = timedOut ? CLOUD_COORDINATOR_TIMEOUT_REPLY : `Sideboard coordinator error: ${msg}`;
+    await api.submitResponse(task.id, reply).catch(() => void 0);
+    log(`replied error ${task.id.slice(0, 8)}: ${msg}`);
+    if (!timedOut) throw err;
+  }
+}
+async function runCloudConnect(opts) {
+  const log = opts.onLog ?? console.log;
+  const api = opts.api ?? new BrightsySideboardApi(
+    opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : void 0
+  );
+  const enableAccess = opts.enableAccess !== false;
+  const allowAlways = opts.allowAlways !== false;
+  const pollMs = opts.pollIntervalMs ?? POLL_MS;
+  const workspaces = refreshWorkspaces();
+  const coordinator = ensureCloudCoordinator(opts.agent);
+  const access = await api.getAccess();
+  if (!access.enabled) {
+    if (!enableAccess) {
+      throw new Error(
+        "Brightsy desktop access is disabled. Enable Cloud messages in Sideboard Settings \u2192 Brightsy, or Brightsy User Settings."
+      );
+    }
+    log("Enabling Brightsy desktop access\u2026");
+    await api.setAccess(true, allowAlways);
+  } else if (allowAlways && !access.allow_always) {
+    await api.setAccess(true, true);
+  }
+  log(
+    `Connected to Brightsy (${api.endpoint}). Polling desktop tasks every ${pollMs / 1e3}s\u2026`
+  );
+  log(
+    `Global coordinator: ${coordinator.id.slice(0, 8)}  agent: ${opts.agent}  global chats: ${listGlobalThreads().length}`
+  );
+  log(`Workspaces (${workspaces.length}):`);
+  for (const line of formatWorkspaceInventory(workspaces).split("\n")) {
+    log(`  ${line}`);
+  }
+  const inFlight = /* @__PURE__ */ new Set();
+  let consecutivePollFailures = 0;
+  while (!opts.signal?.aborted) {
+    try {
+      const hadFailures = consecutivePollFailures > 0;
+      const [pending, awaiting, running] = await Promise.all([
+        api.getTasks("pending"),
+        api.getTasks("awaiting_confirmation"),
+        api.getTasks("running")
+      ]);
+      consecutivePollFailures = 0;
+      if (hadFailures) log("poll recovered");
+      const tasks = [...awaiting, ...pending, ...running];
+      for (const task of tasks) {
+        if (inFlight.has(task.id)) continue;
+        if (task.task_status === "running") continue;
+        inFlight.add(task.id);
+        const message = taskMessageText(task);
+        if (message && parseForceStopMessage(message).forceStop) {
+          try {
+            getOrchestrator().stop(ensureCloudCoordinator(opts.agent).id);
+            log(
+              `force-stop interrupt ${task.id.slice(0, 8)} \u2192 coordinator`
+            );
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log(`force-stop interrupt ${task.id.slice(0, 8)}: ${msg}`);
+          }
+        }
+        void enqueueHandleTask(() => handleTask(api, task, opts)).catch((err) => {
+          const msg = err instanceof Error ? err.message : String(err);
+          log(`error ${task.id.slice(0, 8)}: ${msg}`);
+        }).finally(() => inFlight.delete(task.id));
+      }
+    } catch (err) {
+      consecutivePollFailures += 1;
+      const msg = err instanceof Error ? err.message : String(err);
+      if (consecutivePollFailures === 1) {
+        log(`poll retry: ${msg}`);
+      } else {
+        log(`poll error: ${msg}`);
+      }
+    }
+    await new Promise((resolve) => {
+      const t = setTimeout(resolve, pollMs);
+      opts.signal?.addEventListener(
+        "abort",
+        () => {
+          clearTimeout(t);
+          resolve();
+        },
+        { once: true }
+      );
+    });
+  }
+}
+
+// src/slack/oauth.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { createServer as createServer3 } from "http";
+
+// src/slack/baked-app.ts
+var BAKED_SLACK_CLIENT_ID = "7592788819232.11813536272562";
+var BAKED_SLACK_CLIENT_SECRET = "10290abf6ad0dc11fe6fc321a6215299";
+var BAKED_SLACK_RELAY_URL = "wss://slack-relay.sideboard.cloud/desktop";
+function hasBakedSlackOAuth() {
+  return Boolean(BAKED_SLACK_CLIENT_ID.trim() && BAKED_SLACK_CLIENT_SECRET.trim());
+}
+function slackRelayUrl() {
+  return process.env.SIDEBOARD_SLACK_RELAY_URL?.trim() || BAKED_SLACK_RELAY_URL.trim();
+}
+
+// src/slack/oauth.ts
+var SLACK_OAUTH_PORT = 19847;
+var SLACK_OAUTH_REDIRECT = `http://127.0.0.1:${SLACK_OAUTH_PORT}/callback`;
+var SLACK_BOT_SCOPES = [
+  "app_mentions:read",
+  "channels:history",
+  "channels:read",
+  "groups:history",
+  "groups:read",
+  "im:history",
+  "im:read",
+  "im:write",
+  "mpim:history",
+  "mpim:read",
+  "chat:write",
+  "chat:write.public",
+  "reactions:write",
+  "users:read",
+  "users:read.email",
+  "team:read"
+].join(",");
+var SLACK_USER_SCOPES = [
+  "search:read",
+  "channels:history",
+  "channels:read",
+  "groups:history",
+  "im:history",
+  "mpim:history",
+  "chat:write",
+  "users:read"
+].join(",");
+function slackOAuthCredentials() {
+  const settings = loadAppSettings();
+  const clientId = process.env.SIDEBOARD_SLACK_CLIENT_ID?.trim() || settings.integrations.slackClientId?.trim() || BAKED_SLACK_CLIENT_ID.trim();
+  const clientSecret = process.env.SIDEBOARD_SLACK_CLIENT_SECRET?.trim() || settings.integrations.slackClientSecret?.trim() || BAKED_SLACK_CLIENT_SECRET.trim();
+  if (!clientId || !clientSecret) {
+    throw new Error(
+      "Slack browser sign-in needs a Slack app Client ID and Secret (Account \u2192 Slack, or SIDEBOARD_SLACK_CLIENT_ID / SIDEBOARD_SLACK_CLIENT_SECRET). You can still paste an xoxb- or xoxp- token."
+    );
+  }
+  return { clientId, clientSecret };
+}
+function slackOAuthAuthorizeUrl(clientId, state) {
+  const params = new URLSearchParams({
+    client_id: clientId,
+    scope: SLACK_BOT_SCOPES,
+    user_scope: SLACK_USER_SCOPES,
+    redirect_uri: SLACK_OAUTH_REDIRECT,
+    state
+  });
+  return `https://slack.com/oauth/v2/authorize?${params.toString()}`;
+}
+function htmlPage2(title, body) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>body{font-family:ui-sans-serif,system-ui,sans-serif;padding:48px 24px;max-width:36rem;margin:0 auto;color:#1a1a1a}
+h1{font-size:1.25rem}p{line-height:1.5;color:#444}</style></head><body>${body}</body></html>`;
+}
+async function startSlackOAuth(opts) {
+  const { clientId, clientSecret } = slackOAuthCredentials();
+  const state = randomBytes2(16).toString("hex");
+  const authorizeUrl = slackOAuthAuthorizeUrl(clientId, state);
+  const timeoutMs = opts?.timeoutMs ?? 5 * 6e4;
+  const code = await new Promise((resolve, reject) => {
+    const server = createServer3((req, res2) => {
+      try {
+        const url = new URL(req.url || "/", `http://127.0.0.1:${SLACK_OAUTH_PORT}`);
+        if (url.pathname !== "/callback") {
+          res2.writeHead(404);
+          res2.end("Not found");
+          return;
+        }
+        const err = url.searchParams.get("error");
+        const gotState = url.searchParams.get("state");
+        const gotCode = url.searchParams.get("code");
+        if (err) {
+          res2.writeHead(400, { "Content-Type": "text/html" });
+          res2.end(htmlPage2("Slack", `<h1>Authorization cancelled</h1><p>${err}</p>`));
+          cleanup();
+          reject(new Error(`Slack OAuth: ${err}`));
+          return;
+        }
+        if (gotState !== state || !gotCode) {
+          res2.writeHead(400, { "Content-Type": "text/html" });
+          res2.end(htmlPage2("Slack", "<h1>Invalid callback</h1><p>State or code missing.</p>"));
+          cleanup();
+          reject(new Error("Slack OAuth callback was invalid"));
+          return;
+        }
+        res2.writeHead(200, { "Content-Type": "text/html" });
+        res2.end(
+          htmlPage2(
+            "Slack connected",
+            "<h1>Slack workspace connected</h1><p>You can close this tab and return to Sideboard.</p>"
+          )
+        );
+        cleanup();
+        resolve(gotCode);
+      } catch (e) {
+        cleanup();
+        reject(e instanceof Error ? e : new Error(String(e)));
+      }
+    });
+    const timer = setTimeout(() => {
+      cleanup();
+      reject(new Error("Slack sign-in timed out \u2014 try again"));
+    }, timeoutMs);
+    const cleanup = () => {
+      clearTimeout(timer);
+      server.close();
+    };
+    server.on("error", (e) => {
+      cleanup();
+      reject(
+        e instanceof Error && e.code === "EADDRINUSE" ? new Error(
+          `Port ${SLACK_OAUTH_PORT} is in use. Close whatever is bound there, or paste a Slack token instead.`
+        ) : e
+      );
+    });
+    server.listen(SLACK_OAUTH_PORT, "127.0.0.1", () => {
+      void Promise.resolve(opts?.openUrl?.(authorizeUrl)).catch((e) => {
+        cleanup();
+        reject(e instanceof Error ? e : new Error(String(e)));
+      });
+    });
+  });
+  const body = new URLSearchParams({
+    client_id: clientId,
+    client_secret: clientSecret,
+    code,
+    redirect_uri: SLACK_OAUTH_REDIRECT
+  });
+  const res = await fetch("https://slack.com/api/oauth.v2.access", {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body
+  });
+  const data = await res.json();
+  if (!data.ok) {
+    throw new Error(`Slack OAuth exchange failed: ${data.error || res.status}`);
+  }
+  const teamId = data.team?.id?.trim();
+  if (!teamId) throw new Error("Slack OAuth did not return a team id");
+  return upsertSlackWorkspace({
+    team_id: teamId,
+    team_name: data.team?.name?.trim() || teamId,
+    user_id: data.authed_user?.id,
+    bot_token: data.access_token,
+    user_token: data.authed_user?.access_token,
+    scopes: [data.scope, data.authed_user?.scope].filter(Boolean).join(","),
+    connected_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+}
+
+// src/slack/socket-mode.ts
+import { WebSocket as WsWebSocket } from "ws";
+var BACKOFF_START_MS = 1e3;
+var BACKOFF_MAX_MS = 3e4;
+function stripSlackMentions(text2) {
+  return text2.replace(/<@[^>]+>/g, "").replace(/\s+/g, " ").trim();
+}
+function isSlackStopCommand(text2) {
+  const t = stripSlackMentions(text2).toLowerCase();
+  return t === "stop" || t === "sideboard_force_stop";
+}
+function parseSlackSocketFrame(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function inboundFromSocketFrame(frame) {
+  if (frame.type !== "events_api") return null;
+  const event = frame.payload?.event;
+  if (!event) return null;
+  if (event.bot_id) return null;
+  if (event.subtype) return null;
+  const channelId = event.channel?.trim();
+  const ts = event.ts?.trim();
+  if (!channelId || !ts) return null;
+  const rawText = event.text?.trim() ?? "";
+  const text2 = stripSlackMentions(rawText);
+  if (!text2) return null;
+  const teamId = (frame.payload?.team_id || event.team || "").trim();
+  if (!teamId) return null;
+  const isDm = event.type === "message" && (event.channel_type === "im" || event.channel_type === "mpim" || !event.channel_type && channelId.startsWith("D"));
+  const isMention = event.type === "app_mention";
+  if (!isDm && !isMention) return null;
+  return {
+    teamId,
+    channelId,
+    ts,
+    threadTs: event.thread_ts?.trim() || void 0,
+    userId: event.user?.trim(),
+    text: text2,
+    kind: isMention ? "mention" : "dm"
+  };
+}
+async function openSlackSocketUrl(appToken, fetchImpl) {
+  const token = appToken.trim();
+  if (!token.startsWith("xapp-")) {
+    throw new Error(
+      "Socket Mode needs an app-level token (xapp-\u2026) with connections:write. Create one on the Slack app \u2192 Basic Information \u2192 App-Level Tokens."
+    );
+  }
+  const doFetch = fetchImpl ?? fetch;
+  const res = await doFetch("https://slack.com/api/apps.connections.open", {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams()
+  });
+  const json = await res.json();
+  if (!json.ok) {
+    throw new SlackApiError("apps.connections.open", json.error || `HTTP ${res.status}`);
+  }
+  const url = json.url?.trim();
+  if (!url) throw new Error("Slack apps.connections.open did not return a WebSocket URL");
+  return url;
+}
+function messageToString(data) {
+  if (typeof data === "string") return data;
+  if (Buffer.isBuffer(data)) return data.toString("utf8");
+  if (Array.isArray(data)) return Buffer.concat(data).toString("utf8");
+  if (data instanceof ArrayBuffer) return Buffer.from(data).toString("utf8");
+  return String(data ?? "");
+}
+function nodeWebSocketCtor() {
+  return class NodeSlackWebSocket {
+    socket;
+    constructor(url) {
+      this.socket = new WsWebSocket(url);
+    }
+    send(data) {
+      this.socket.send(data);
+    }
+    close(code, reason) {
+      this.socket.close(code, reason);
+    }
+    addEventListener(type, listener) {
+      if (type === "message") {
+        this.socket.on("message", (data) => listener({ data: messageToString(data) }));
+        return;
+      }
+      this.socket.on(type, () => listener({}));
+    }
+  };
+}
+function resolveWebSocket(ctor) {
+  if (ctor) return ctor;
+  const globalWs = globalThis.WebSocket;
+  if (globalWs) return globalWs;
+  return nodeWebSocketCtor();
+}
+function wait(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("aborted"));
+      return;
+    }
+    const t = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(t);
+        reject(new Error("aborted"));
+      },
+      { once: true }
+    );
+  });
+}
+async function runSlackSocketMode(opts) {
+  const log = opts.onLog ?? (() => void 0);
+  const Ws = resolveWebSocket(opts.WebSocketImpl);
+  let backoff = BACKOFF_START_MS;
+  while (!opts.signal?.aborted) {
+    let ws = null;
+    try {
+      const url = await openSlackSocketUrl(opts.appToken, opts.fetchImpl);
+      ws = new Ws(url);
+      const session = connectSession(ws, opts, log);
+      backoff = BACKOFF_START_MS;
+      await session;
+    } catch (err) {
+      if (opts.signal?.aborted) return;
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg === "aborted") return;
+      log(`socket error: ${msg}`);
+    } finally {
+      try {
+        ws?.close();
+      } catch {
+      }
+    }
+    if (opts.signal?.aborted) return;
+    log(`reconnect in ${Math.round(backoff / 1e3)}s`);
+    try {
+      await wait(backoff, opts.signal);
+    } catch {
+      return;
+    }
+    backoff = Math.min(backoff * 2, BACKOFF_MAX_MS);
+  }
+}
+function connectSession(ws, opts, log) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (err) => {
+      if (settled) return;
+      settled = true;
+      opts.signal?.removeEventListener("abort", onAbort);
+      if (err) reject(err);
+      else resolve();
+    };
+    const onAbort = () => {
+      try {
+        ws.close();
+      } catch {
+      }
+      finish();
+    };
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    ws.addEventListener("open", () => {
+      log("Socket Mode connected");
+    });
+    ws.addEventListener("error", () => {
+      finish(new Error("WebSocket error"));
+    });
+    ws.addEventListener("close", () => {
+      finish();
+    });
+    ws.addEventListener("message", (ev) => {
+      const raw = typeof ev.data === "string" ? ev.data : String(ev.data ?? "");
+      const frame = parseSlackSocketFrame(raw);
+      if (!frame) return;
+      if (frame.envelope_id) {
+        try {
+          ws.send(JSON.stringify({ envelope_id: frame.envelope_id }));
+        } catch {
+        }
+      }
+      if (frame.type === "hello") {
+        log("Socket Mode hello");
+        return;
       }
-    );
-    server.tool(
-      "list_linear_issues",
-      "Deprecated: prefer list_issues. Lists assigned Linear issues via the chosen agent MCP connector",
-      {
-        agent: z.enum(["claude", "codex", "opencode"]),
-        repoPath: z.string()
-      },
-      async ({ agent, repoPath }) => {
-        const issues = await listLinearIssues(agent, repoPath);
-        return { content: [{ type: "text", text: JSON.stringify(issues, null, 2) }] };
+      if (frame.type === "disconnect") {
+        log(`socket disconnect: ${frame.reason || "refresh"}`);
+        try {
+          ws.close();
+        } catch {
+        }
+        return;
       }
-    );
-  }
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
+      const inbound = inboundFromSocketFrame(frame);
+      if (!inbound) return;
+      void Promise.resolve(opts.onEvent(inbound)).catch((err) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        log(`event error: ${msg}`);
+      });
+    });
+  });
 }
 
-// src/brightsy/api.ts
-function formatBrightsyFetchError(err, url) {
-  if (!(err instanceof Error)) return `${String(err)} (${url})`;
-  const cause = err.cause;
-  let detail = "";
-  if (cause instanceof Error) {
-    const code = typeof cause.code === "string" ? cause.code : void 0;
-    detail = code ? ` [${code}: ${cause.message}]` : ` [${cause.message}]`;
-  } else if (cause != null) {
-    detail = ` [${String(cause)}]`;
+// src/slack/reply-target.ts
+import { existsSync as existsSync15, readFileSync as readFileSync10 } from "fs";
+import { join as join13 } from "path";
+function storePath3() {
+  return join13(appDataDir(), "slack-reply-to.json");
+}
+function readStore3() {
+  const path = storePath3();
+  if (!existsSync15(path)) return {};
+  try {
+    const parsed = isSecureFileEncrypted(path) ? readSecureJson(path) : JSON.parse(readFileSync10(path, "utf8"));
+    return parsed?.targets && typeof parsed.targets === "object" ? parsed.targets : {};
+  } catch {
+    return {};
   }
-  return `${err.message}${detail} (${url})`;
 }
-var BrightsySideboardApi = class {
-  cfg;
-  fetchImpl;
-  constructor(cfgOrOpts) {
-    const isOpts = !!cfgOrOpts && typeof cfgOrOpts === "object" && ("fetchImpl" in cfgOrOpts || "cfg" in cfgOrOpts) && !("access_token" in cfgOrOpts);
-    if (isOpts) {
-      const opts = cfgOrOpts;
-      this.cfg = opts.cfg ?? loadBrightsyConfig();
-      this.fetchImpl = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
-    } else {
-      this.cfg = cfgOrOpts ?? loadBrightsyConfig();
-      this.fetchImpl = globalThis.fetch.bind(globalThis);
+function setSlackReplyTarget(target) {
+  const targets = readStore3();
+  targets[target.threadId] = target;
+  writePrivateFile(storePath3(), `${JSON.stringify({ targets }, null, 2)}
+`);
+}
+function getSlackReplyTarget(threadId) {
+  return readStore3()[threadId] ?? null;
+}
+
+// src/slack/relay-protocol.ts
+import { randomBytes as randomBytes3 } from "crypto";
+function slackRelaySessionKey(teamId, userId, deviceId) {
+  return `${teamId.trim()}:${userId.trim()}:${deviceId.trim()}`;
+}
+function slackRelayUserKey(teamId, userId) {
+  return `${teamId.trim()}:${userId.trim()}`;
+}
+function newSlackRelayEventId() {
+  return randomBytes3(12).toString("hex");
+}
+function parseSlackRelayClientMessage(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || !("type" in parsed)) return null;
+    if (parsed.type === "ping") return { type: "ping" };
+    if (parsed.type === "claim") {
+      const eventId = typeof parsed.eventId === "string" ? parsed.eventId.trim() : "";
+      if (!eventId) return null;
+      return { type: "claim", eventId };
+    }
+    if (parsed.type === "register") {
+      const teamId = typeof parsed.teamId === "string" ? parsed.teamId.trim() : "";
+      const userId = typeof parsed.userId === "string" ? parsed.userId.trim() : "";
+      const deviceId = typeof parsed.deviceId === "string" ? parsed.deviceId.trim() : "";
+      const deviceLabel = typeof parsed.deviceLabel === "string" ? parsed.deviceLabel.trim() : void 0;
+      const botToken = typeof parsed.botToken === "string" ? parsed.botToken.trim() : "";
+      const userToken = typeof parsed.userToken === "string" ? parsed.userToken.trim() : "";
+      if (!teamId || !userId || !deviceId || !botToken || !userToken) return null;
+      return {
+        type: "register",
+        teamId,
+        userId,
+        deviceId,
+        deviceLabel: deviceLabel || void 0,
+        botToken,
+        userToken
+      };
     }
+    return null;
+  } catch {
+    return null;
   }
-  get accountId() {
-    return this.cfg.account_id;
-  }
-  get endpoint() {
-    return (this.cfg.endpoint || "https://brightsy.ai").replace(/\/$/, "");
-  }
-  async request(path, init = {}) {
-    await this.refreshIfNeeded();
-    const url = `${this.endpoint}${path}`;
-    const headers = {
-      Authorization: `Bearer ${this.cfg.access_token}`,
-      Accept: "application/json"
-    };
-    if (init.body != null) headers["Content-Type"] = "application/json";
-    let res;
-    try {
-      res = await this.fetchImpl(url, {
-        method: init.method ?? "GET",
-        headers,
-        body: init.body != null ? JSON.stringify(init.body) : void 0
-      });
-    } catch (err) {
-      throw new Error(formatBrightsyFetchError(err, url));
+}
+function parseSlackRelayServerMessage(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || !("type" in parsed)) return null;
+    if (parsed.type === "pong") return { type: "pong" };
+    if (parsed.type === "registered") {
+      const teamId = typeof parsed.teamId === "string" ? parsed.teamId.trim() : "";
+      const userId = typeof parsed.userId === "string" ? parsed.userId.trim() : "";
+      const deviceId = typeof parsed.deviceId === "string" ? parsed.deviceId.trim() : "";
+      if (!teamId || !userId) return null;
+      return { type: "registered", teamId, userId, deviceId: deviceId || "unknown" };
+    }
+    if (parsed.type === "claim_ok" || parsed.type === "claim_denied") {
+      const eventId = typeof parsed.eventId === "string" ? parsed.eventId.trim() : "";
+      if (!eventId) return null;
+      return { type: parsed.type, eventId };
+    }
+    if (parsed.type === "error") {
+      const message = typeof parsed.message === "string" ? parsed.message : "error";
+      return { type: "error", message };
+    }
+    if (parsed.type === "event") {
+      const eventId = typeof parsed.eventId === "string" && parsed.eventId.trim() ? parsed.eventId.trim() : `legacy-${Date.now()}`;
+      const msg = parsed.message;
+      if (!msg || typeof msg !== "object") return null;
+      if (typeof msg.teamId !== "string" || typeof msg.channelId !== "string" || typeof msg.ts !== "string" || typeof msg.text !== "string" || msg.kind !== "dm" && msg.kind !== "mention") {
+        return null;
+      }
+      return { type: "event", eventId, message: msg };
     }
-    if (!res.ok) {
-      const err = await res.json().catch(() => ({}));
-      throw new Error(err.error?.message ?? `${res.status} ${res.statusText} (${url})`);
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+// src/slack/relay-client.ts
+var BACKOFF_START_MS2 = 1e3;
+var BACKOFF_MAX_MS2 = 3e4;
+function wait2(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new Error("aborted"));
+      return;
     }
-    return await res.json();
+    const t = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(t);
+        reject(new Error("aborted"));
+      },
+      { once: true }
+    );
+  });
+}
+function send(ws, msg) {
+  ws.send(JSON.stringify(msg));
+}
+async function runSlackRelayClient(opts) {
+  const log = opts.onLog ?? (() => void 0);
+  const Ws = resolveWebSocket(opts.WebSocketImpl);
+  const url = opts.url.trim();
+  const deviceId = opts.deviceId.trim();
+  if (!url) throw new Error("Slack relay URL is empty");
+  if (!deviceId) throw new Error("Slack relay needs a deviceId for this Mac");
+  if (opts.workspaces.length === 0) {
+    throw new Error(
+      "Slack relay needs a connected workspace with bot + user tokens (Add via browser)."
+    );
   }
-  async refreshIfNeeded() {
-    const expiresAt = this.cfg.expires_at ?? 0;
-    if (!this.cfg.refresh_token || Date.now() < expiresAt - 6e4) return;
-    const clientId = this.cfg.oauth_client_id || "brightsy-cli";
-    const url = `${this.endpoint}/oauth/token`;
-    let res;
+  let backoff = BACKOFF_START_MS2;
+  while (!opts.signal?.aborted) {
+    let ws = null;
     try {
-      res = await this.fetchImpl(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          grant_type: "refresh_token",
-          refresh_token: this.cfg.refresh_token,
-          client_id: clientId
-        })
-      });
+      ws = new Ws(url);
+      await connectSession2(ws, opts, log);
+      backoff = BACKOFF_START_MS2;
     } catch (err) {
-      throw new Error(formatBrightsyFetchError(err, url));
+      if (opts.signal?.aborted) return;
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg === "aborted") return;
+      log(`relay error: ${msg}`);
+    } finally {
+      try {
+        ws?.close();
+      } catch {
+      }
     }
-    if (!res.ok) return;
-    const data = await res.json();
-    if (!data.access_token) return;
-    this.cfg.access_token = data.access_token;
-    if (data.refresh_token) this.cfg.refresh_token = data.refresh_token;
-    if (data.expires_in) {
-      this.cfg.expires_at = Date.now() + data.expires_in * 1e3;
+    if (opts.signal?.aborted) return;
+    log(`relay reconnect in ${Math.round(backoff / 1e3)}s`);
+    try {
+      await wait2(backoff, opts.signal);
+    } catch {
+      return;
     }
-    saveBrightsyConfig(this.cfg);
+    backoff = Math.min(backoff * 2, BACKOFF_MAX_MS2);
   }
-  async getAccess() {
-    return this.request(
-      `/api/v1beta/desktop/access?accountId=${encodeURIComponent(this.accountId)}`
+}
+function connectSession2(ws, opts, log) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const pending = /* @__PURE__ */ new Map();
+    const allowedUsers = new Set(
+      opts.workspaces.map((w) => `${w.teamId.trim()}:${w.userId.trim()}`)
     );
-  }
-  async setAccess(enabled, allow_always = false) {
-    return this.request("/api/v1beta/desktop/access", {
-      method: "PUT",
-      body: {
-        accountId: this.accountId,
-        enabled,
-        allow_always
+    const finish = (err) => {
+      if (settled) return;
+      settled = true;
+      pending.clear();
+      opts.signal?.removeEventListener("abort", onAbort);
+      if (err) reject(err);
+      else resolve();
+    };
+    const onAbort = () => {
+      try {
+        ws.close();
+      } catch {
+      }
+      finish();
+    };
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    ws.addEventListener("open", () => {
+      const label = opts.deviceLabel?.trim() || opts.deviceId.trim();
+      log(`Relay connected \xB7 ${label}`);
+      for (const wsInfo of opts.workspaces) {
+        send(ws, {
+          type: "register",
+          teamId: wsInfo.teamId,
+          userId: wsInfo.userId,
+          deviceId: opts.deviceId.trim(),
+          deviceLabel: opts.deviceLabel?.trim() || void 0,
+          botToken: wsInfo.botToken,
+          userToken: wsInfo.userToken
+        });
       }
     });
-  }
-  async getTasks(status) {
-    const params = new URLSearchParams();
-    if (status) params.set("status", status);
-    params.set("accountId", this.accountId);
-    const q = `?${params.toString()}`;
-    const data = await this.request(
-      `/api/v1beta/desktop/tasks${q}`
-    );
-    return data.tasks ?? [];
-  }
-  async approveTask(taskId) {
-    await this.request(`/api/v1beta/desktop/tasks/${taskId}`, {
-      method: "PATCH",
-      body: { action: "approve" }
+    ws.addEventListener("error", () => {
+      finish(new Error("WebSocket error"));
     });
-  }
-  async markRunning(taskId) {
-    await this.request(`/api/v1beta/desktop/tasks/${taskId}`, {
-      method: "PATCH",
-      body: { task_status: "running" }
+    ws.addEventListener("close", () => {
+      finish();
     });
-  }
-  async submitResponse(taskId, response) {
-    await this.request(`/api/v1beta/desktop/tasks/${taskId}/response`, {
-      method: "POST",
-      body: { response }
+    ws.addEventListener("message", (ev) => {
+      const raw = typeof ev.data === "string" ? ev.data : String(ev.data ?? "");
+      const msg = parseSlackRelayServerMessage(raw);
+      if (!msg) return;
+      if (msg.type === "pong") return;
+      if (msg.type === "error") {
+        log(`relay error: ${msg.message}`);
+        return;
+      }
+      if (msg.type === "registered") {
+        log(
+          msg.deviceId && msg.deviceId !== "unknown" ? `Relay registered ${msg.teamId}/${msg.userId} \xB7 device ${msg.deviceId.slice(0, 8)}\u2026` : `Relay registered ${msg.teamId}/${msg.userId}`
+        );
+        return;
+      }
+      if (msg.type === "event") {
+        const key = `${msg.message.teamId.trim()}:${(msg.message.userId ?? "").trim()}`;
+        if (!allowedUsers.has(key)) {
+          log(`relay skip: event for ${key} not owned by this desktop`);
+          return;
+        }
+        pending.set(msg.eventId, msg.message);
+        send(ws, { type: "claim", eventId: msg.eventId });
+        const eventId = msg.eventId;
+        setTimeout(() => {
+          const inbound = pending.get(eventId);
+          if (!inbound) return;
+          pending.delete(eventId);
+          void Promise.resolve(opts.onEvent(inbound)).catch((err) => {
+            const errMsg = err instanceof Error ? err.message : String(err);
+            log(`event error: ${errMsg}`);
+          });
+        }, 400);
+        return;
+      }
+      if (msg.type === "claim_denied") {
+        pending.delete(msg.eventId);
+        return;
+      }
+      if (msg.type === "claim_ok") {
+        const inbound = pending.get(msg.eventId);
+        pending.delete(msg.eventId);
+        if (!inbound) return;
+        void Promise.resolve(opts.onEvent(inbound)).catch((err) => {
+          const errMsg = err instanceof Error ? err.message : String(err);
+          log(`event error: ${errMsg}`);
+        });
+      }
     });
-  }
-};
-function taskMessageText(task) {
-  const parts = task.message?.parts ?? [];
-  const text = parts.find((p) => p.kind === "text")?.text ?? "";
-  return text.trim();
+  });
 }
 
-// src/brightsy/cloud-connect.ts
-var POLL_MS = 5e3;
-var handleTaskChain = Promise.resolve();
-function enqueueHandleTask(fn) {
-  const run2 = handleTaskChain.then(fn, fn);
-  handleTaskChain = run2.then(
+// src/slack/listen.ts
+var SLACK_LISTEN_BUSY_REPLY = [
+  "Sideboard is busy with an in-progress turn.",
+  "I did not start a new request.",
+  'Send "stop" to interrupt, or try again when idle.'
+].join(" ");
+var SLACK_LISTEN_STOPPED_REPLY = "Sideboard stopped the in-progress turn. Send another message when you want to continue.";
+var SLACK_LISTEN_TIMEOUT_REPLY = [
+  "Sideboard timed out waiting for the local agent turn to finish.",
+  'Send "stop" to interrupt, or try again.'
+].join(" ");
+var handleChain = Promise.resolve();
+function enqueueHandle(fn) {
+  const run2 = handleChain.then(fn, fn);
+  handleChain = run2.then(
     () => void 0,
     () => void 0
   );
   return run2;
 }
-function refreshWorkspaces() {
-  const orch = getOrchestrator();
-  return orch.listWorkspaces();
+function refreshWorkspaces2() {
+  return getOrchestrator().listWorkspaces();
+}
+function formatSlackInboundPrompt(msg) {
+  const kind = msg.kind === "mention" ? "Slack @mention" : "Slack DM";
+  return `${kind}
+
+${msg.text}`;
+}
+function isSlackInboundUserPrompt(text2) {
+  return text2.startsWith("Slack DM\n") || text2.startsWith("Slack @mention\n");
+}
+function formatSlackSignedReply(deviceLabel, text2) {
+  const label = deviceLabel.trim();
+  const body = text2.trim();
+  if (!body) return body;
+  if (!label) return body;
+  const head = `${label}:`;
+  if (body.slice(0, head.length).toLowerCase() === head.toLowerCase()) {
+    return body;
+  }
+  return `${label}: ${body}`;
+}
+function signForThisMac(text2) {
+  return formatSlackSignedReply(ensureSlackDeviceIdentity().deviceLabel, text2);
+}
+function slackReplyThreadTs(msg) {
+  if (msg.threadTs && msg.threadTs !== msg.ts) return msg.threadTs;
+  if (msg.kind === "mention") return msg.ts;
+  return void 0;
+}
+var SLACK_SEEN_REACTION = "+1";
+function writeTokenForTeam(teamId) {
+  const workspaces = listSlackWorkspacesRaw();
+  const ws = workspaces.find((w) => w.team_id === teamId);
+  if (!ws) {
+    const connected = workspaces.map((w) => `${w.team_name} (${w.team_id})`).join(", ");
+    throw new Error(
+      connected ? `No connected Slack workspace for team ${teamId}. Connected: ${connected}` : `No connected Slack workspace for team ${teamId}`
+    );
+  }
+  return slackTokenFor(ws, "write");
+}
+async function ackSlackInboundSeen(msg, opts) {
+  const log = opts.onLog ?? (() => void 0);
+  try {
+    if (opts.addReaction) {
+      await opts.addReaction(msg, SLACK_SEEN_REACTION);
+      return;
+    }
+    await slackApi(
+      writeTokenForTeam(msg.teamId),
+      "reactions.add",
+      {
+        channel: msg.channelId,
+        timestamp: msg.ts,
+        name: SLACK_SEEN_REACTION
+      },
+      opts.fetchImpl
+    );
+  } catch (err) {
+    if (err instanceof SlackApiError && err.slackError === "already_reacted") return;
+    const errMsg = err instanceof Error ? err.message : String(err);
+    const hint = err instanceof SlackApiError && err.slackError === "missing_scope" ? " \u2014 reconnect Slack in Account to grant reactions:write" : "";
+    log(`react error: ${errMsg}${hint}`);
+  }
+}
+async function postSlackText(target, text2, opts) {
+  const stub = {
+    teamId: target.teamId,
+    channelId: target.channelId,
+    ts: target.threadTs ?? "",
+    threadTs: target.threadTs,
+    text: "",
+    kind: "dm"
+  };
+  if (opts.postReply) {
+    await opts.postReply(stub, text2);
+    return;
+  }
+  const token = writeTokenForTeam(target.teamId);
+  await slackApi(
+    token,
+    "chat.postMessage",
+    {
+      channel: target.channelId,
+      text: text2,
+      thread_ts: target.threadTs
+    },
+    opts.fetchImpl
+  );
+}
+async function postSlackReply(msg, text2, opts) {
+  await postSlackText(
+    {
+      teamId: msg.teamId,
+      channelId: msg.channelId,
+      threadTs: slackReplyThreadTs(msg)
+    },
+    signForThisMac(text2),
+    opts
+  );
+}
+var lastRelayed = /* @__PURE__ */ new Map();
+function markRelayed(threadId, text2) {
+  lastRelayed.set(threadId, `${threadId}:${text2}`);
 }
-async function handleTask(api, task, opts) {
+function alreadyRelayed(threadId, text2) {
+  return lastRelayed.get(threadId) === `${threadId}:${text2}`;
+}
+async function relayCoordinatorReplyToSlack(threadId, opts) {
+  const target = getSlackReplyTarget(threadId);
+  if (!target) return;
+  const thread = readThread(threadId);
+  const lastUser = thread ? [...thread.messages].reverse().find((m) => m.role === "user") : void 0;
+  if (lastUser && isSlackInboundUserPrompt(lastUser.text)) return;
+  const result = getOrchestrator().getTurnResult(threadId);
+  const text2 = result.text.trim();
+  if (!text2) return;
+  if (alreadyRelayed(threadId, text2)) return;
+  markRelayed(threadId, text2);
   const log = opts.onLog ?? (() => void 0);
-  let message = taskMessageText(task);
-  if (!message) {
-    log(`skip ${task.id.slice(0, 8)}: empty message`);
-    return;
-  }
-  if (task.task_status !== "pending" && task.task_status !== "running" && task.task_status !== "awaiting_confirmation") {
-    return;
+  try {
+    await postSlackText(target, signForThisMac(text2), opts);
+    log(`replied ${target.threadTs ?? target.channelId} (${text2.length} chars)`);
+  } catch (err) {
+    lastRelayed.delete(threadId);
+    const errMsg = err instanceof Error ? err.message : String(err);
+    log(`relay error: ${errMsg}`);
   }
-  const workspaces = refreshWorkspaces();
+}
+async function handleSlackInbound(msg, opts) {
+  const log = opts.onLog ?? (() => void 0);
+  await ackSlackInboundSeen(msg, opts);
+  const agent = coerceOrchestratorAgent(opts.agent ?? getDefaultAgent());
+  const workspaces = refreshWorkspaces2();
   for (const ws of workspaces) {
     await getOrchestrator().reconcile(ws.path).catch(() => void 0);
   }
   const inventory = await enrichWorkspacesWithGithub(workspaces);
-  const coordinator = ensureCloudCoordinator(opts.agent);
-  let fresh = readThread(coordinator.id) ?? coordinator;
-  const parsed = parseForceStopMessage(message);
-  if (parsed.forceStop) {
+  const userId = msg.userId?.trim();
+  if (!userId) {
+    log(`skip ${msg.kind} ${msg.ts}: missing Slack user id`);
+    return;
+  }
+  const coordinator = ensureSlackCoordinator(msg.teamId, userId, agent);
+  const fresh = readThread(coordinator.id) ?? coordinator;
+  if (isSlackStopCommand(msg.text)) {
     try {
       getOrchestrator().stop(fresh.id);
-      log(`force-stop ${task.id.slice(0, 8)} \u2192 coordinator ${fresh.id.slice(0, 8)}`);
+      log(`stop ${msg.kind} ${msg.ts} \u2192 coordinator ${fresh.id.slice(0, 8)}`);
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      log(`force-stop ${task.id.slice(0, 8)}: ${msg}`);
-    }
-    if (!parsed.remainder) {
-      if (task.task_status === "awaiting_confirmation") {
-        await api.approveTask(task.id).catch(() => void 0);
-      }
-      await api.markRunning(task.id).catch(() => void 0);
-      await api.submitResponse(task.id, CLOUD_COORDINATOR_STOPPED_REPLY);
-      log(`replied stopped ${task.id.slice(0, 8)}`);
-      return;
+      const errMsg = err instanceof Error ? err.message : String(err);
+      log(`stop ${msg.ts}: ${errMsg}`);
     }
-    message = parsed.remainder;
-    fresh = readThread(coordinator.id) ?? ensureCloudCoordinator(opts.agent);
+    await postSlackReply(msg, SLACK_LISTEN_STOPPED_REPLY, opts);
+    log(`replied stopped ${msg.ts}`);
+    return;
   }
   if (fresh.status === "running" || fresh.status === "queued") {
-    log(
-      `busy ${task.id.slice(0, 8)} \u2192 coordinator ${fresh.id.slice(0, 8)} (${fresh.status})`
-    );
-    if (task.task_status === "awaiting_confirmation") {
-      await api.approveTask(task.id).catch(() => void 0);
-    }
-    await api.markRunning(task.id).catch(() => void 0);
-    await api.submitResponse(task.id, CLOUD_COORDINATOR_BUSY_REPLY);
-    log(`replied busy ${task.id.slice(0, 8)}`);
+    log(`busy ${msg.kind} ${msg.ts} \u2192 coordinator ${fresh.id.slice(0, 8)} (${fresh.status})`);
+    await postSlackReply(msg, SLACK_LISTEN_BUSY_REPLY, opts);
+    log(`replied busy ${msg.ts}`);
     return;
   }
-  if (task.task_status === "awaiting_confirmation") {
-    log(`approve ${task.id.slice(0, 8)}`);
-    await api.approveTask(task.id);
-    task = { ...task, task_status: "pending" };
-  }
   log(
-    `run ${task.id.slice(0, 8)} \u2192 coordinator ${fresh.id.slice(0, 8)} (${inventory.length} workspace${inventory.length === 1 ? "" : "s"})`
+    `run ${msg.kind} ${msg.ts} user ${userId} \u2192 coordinator ${fresh.id.slice(0, 8)} (${inventory.length} workspace${inventory.length === 1 ? "" : "s"})`
   );
-  await api.markRunning(task.id).catch(() => void 0);
+  const prompt = formatSlackInboundPrompt(msg);
+  setSlackReplyTarget({
+    threadId: fresh.id,
+    teamId: msg.teamId,
+    channelId: msg.channelId,
+    threadTs: slackReplyThreadTs(msg)
+  });
   const orch = getOrchestrator();
-  const prompt = [
-    coordinatorSystemPrompt({
-      goal: fresh.sourceRef || CLOUD_ORCHESTRATOR_GOAL,
-      parentId: fresh.id,
-      workspaces: inventory,
-      audience: "cloud"
-    }),
-    "",
-    "--- Cloud agent request ---",
-    message
-  ].join("\n");
+  let reply;
   try {
     await orch.send(fresh.id, prompt);
     await orch.waitForTurn(fresh.id, 14 * 60 * 1e3);
-    const result = orch.getTurnResult(fresh.id);
-    const reply = result.text.trim() || `(coordinator finished with status ${result.status}, no text)`;
-    await api.submitResponse(task.id, reply);
-    log(`replied ${task.id.slice(0, 8)} (${reply.length} chars)`);
+    reply = orch.getTurnResult(fresh.id).text.trim();
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    const timedOut = /timed out|timeout/i.test(msg);
-    const reply = timedOut ? CLOUD_COORDINATOR_TIMEOUT_REPLY : `Sideboard coordinator error: ${msg}`;
-    await api.submitResponse(task.id, reply).catch(() => void 0);
-    log(`replied error ${task.id.slice(0, 8)}: ${msg}`);
+    const errMsg = err instanceof Error ? err.message : String(err);
+    const timedOut = /timed out|timeout/i.test(errMsg);
+    const errorReply = timedOut ? SLACK_LISTEN_TIMEOUT_REPLY : `Sideboard coordinator error: ${errMsg}`;
+    await postSlackReply(msg, errorReply, opts).catch((postErr) => {
+      const postMsg = postErr instanceof Error ? postErr.message : String(postErr);
+      log(`post error: ${postMsg}`);
+    });
+    log(`replied error ${msg.ts}: ${errMsg}`);
     if (!timedOut) throw err;
+    return;
+  }
+  if (!reply) {
+    log(`post error: no agent text to send for ${msg.ts}`);
+    return;
+  }
+  if (alreadyRelayed(fresh.id, reply)) {
+    log(`turn finished ${msg.ts} (already posted)`);
+    return;
+  }
+  try {
+    await postSlackReply(msg, reply, opts);
+    markRelayed(fresh.id, reply);
+    log(`replied ${msg.ts} (${reply.length} chars)`);
+  } catch (err) {
+    const errMsg = err instanceof Error ? err.message : String(err);
+    log(`post error: ${errMsg}`);
   }
 }
-async function runCloudConnect(opts) {
+function ownedSlackUserKeys() {
+  const keys = /* @__PURE__ */ new Set();
+  for (const w of listSlackWorkspacesRaw()) {
+    const team = w.team_id?.trim();
+    const user = w.user_id?.trim();
+    if (team && user) keys.add(`${team}:${user}`);
+  }
+  return keys;
+}
+function isInboundForThisDesktop(msg) {
+  const userId = msg.userId?.trim();
+  if (!userId) return false;
+  const owned = ownedSlackUserKeys();
+  return owned.has(`${msg.teamId.trim()}:${userId}`);
+}
+async function runSlackListen(opts = {}) {
   const log = opts.onLog ?? console.log;
-  const api = opts.api ?? new BrightsySideboardApi(
-    opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : void 0
-  );
-  const enableAccess = opts.enableAccess !== false;
-  const allowAlways = opts.allowAlways !== false;
-  const pollMs = opts.pollIntervalMs ?? POLL_MS;
-  const workspaces = refreshWorkspaces();
-  const coordinator = ensureCloudCoordinator(opts.agent);
-  const access = await api.getAccess();
-  if (!access.enabled) {
-    if (!enableAccess) {
+  const connected = listSlackWorkspacesRaw();
+  const orch = getOrchestrator();
+  const off = orch.on((event) => {
+    if (event.type !== "turn_finished") return;
+    void relayCoordinatorReplyToSlack(event.threadId, opts);
+  });
+  const onInbound = (msg) => enqueueHandle(async () => {
+    if (!isInboundForThisDesktop(msg)) {
+      log(
+        `skip ${msg.kind} ${msg.ts}: Slack user ${msg.userId ?? "?"} is not connected on this Mac`
+      );
+      return;
+    }
+    await handleSlackInbound(msg, opts);
+  });
+  try {
+    const relay = (opts.relayUrl ?? slackRelayUrl()).trim();
+    if (!relay) {
+      throw new Error("Slack Listen needs the hosted relay URL.");
+    }
+    const withIdentity = connected.filter(
+      (w) => w.bot_token?.trim() && w.user_token?.trim() && w.user_id?.trim()
+    );
+    if (withIdentity.length === 0) {
       throw new Error(
-        "Brightsy desktop access is disabled. Enable Cloud messages in Sideboard Settings \u2192 Brightsy, or Brightsy User Settings."
+        "Slack Listen needs Add via browser (bot token + your Slack user id). Paste-only bot tokens cannot prove which Slack user owns this Mac."
       );
     }
-    log("Enabling Brightsy desktop access\u2026");
-    await api.setAccess(true, allowAlways);
-  } else if (allowAlways && !access.allow_always) {
-    await api.setAccess(true, true);
+    const device = ensureSlackDeviceIdentity();
+    log(
+      `Relay listen \xB7 ${device.deviceLabel} \xB7 ${withIdentity.length} workspace${withIdentity.length === 1 ? "" : "s"} as Slack user: ${withIdentity.map((w) => `${w.team_name}/${w.user_id}`).join(", ")}`
+    );
+    await runSlackRelayClient({
+      url: relay,
+      signal: opts.signal,
+      onLog: log,
+      WebSocketImpl: opts.WebSocketImpl,
+      deviceId: device.deviceId,
+      deviceLabel: device.deviceLabel,
+      workspaces: withIdentity.map((w) => ({
+        teamId: w.team_id,
+        userId: w.user_id.trim(),
+        botToken: w.bot_token.trim(),
+        userToken: w.user_token.trim()
+      })),
+      onEvent: onInbound
+    });
+  } finally {
+    off();
   }
-  log(
-    `Connected to Brightsy (${api.endpoint}). Polling desktop tasks every ${pollMs / 1e3}s\u2026`
-  );
-  log(
-    `Global coordinator: ${coordinator.id.slice(0, 8)}  agent: ${opts.agent}  global chats: ${listGlobalThreads().length}`
-  );
-  log(`Workspaces (${workspaces.length}):`);
-  for (const line of formatWorkspaceInventory(workspaces).split("\n")) {
-    log(`  ${line}`);
+}
+function resolveSlackListenMode(opts) {
+  const relay = (opts?.relayUrl ?? slackRelayUrl()).trim();
+  const count = opts?.workspaceCount ?? listSlackWorkspacesRaw().filter(
+    (w) => w.bot_token?.trim() && w.user_token?.trim() && w.user_id?.trim()
+  ).length;
+  if (relay && count > 0) return "relay";
+  return null;
+}
+
+// src/slack/relay-hub.ts
+function parseSlackDeviceDestination(text2) {
+  const m = text2.match(/^\s*(?:to\s+)?(?:@|#)?([A-Za-z][\w-]{0,63})\s*[:：]\s*/);
+  if (!m) return { label: null, rest: text2 };
+  return { label: m[1], rest: text2.slice(m[0].length) };
+}
+var SlackRelayHub = class {
+  sessions = /* @__PURE__ */ new Map();
+  bySocket = /* @__PURE__ */ new Map();
+  pendingClaims = /* @__PURE__ */ new Map();
+  seq = 0;
+  fetchImpl;
+  authTest;
+  log;
+  constructor(opts = {}) {
+    this.fetchImpl = opts.fetchImpl;
+    this.log = opts.onLog ?? (() => void 0);
+    this.authTest = opts.authTest ?? (async (token) => slackApi(token, "auth.test", void 0, this.fetchImpl));
+  }
+  sessionFor(teamId, userId, deviceId) {
+    return this.sessions.get(slackRelaySessionKey(teamId, userId, deviceId)) ?? null;
+  }
+  sessionsForUser(teamId, userId) {
+    const t = teamId.trim();
+    const u = userId.trim();
+    return [...this.sessions.values()].filter((s) => s.teamId === t && s.userId === u);
+  }
+  listSessions() {
+    return [...this.sessions.values()];
+  }
+  detachSocket(socket) {
+    const key = this.bySocket.get(socket);
+    this.bySocket.delete(socket);
+    if (!key) return;
+    const current = this.sessions.get(key);
+    if (current?.socket === socket) {
+      this.sessions.delete(key);
+      this.log(`desktop disconnected ${key}`);
+    }
+  }
+  async handleClientMessage(socket, msg) {
+    if (msg.type === "ping") {
+      this.send(socket, { type: "pong" });
+      return;
+    }
+    if (msg.type === "claim") {
+      this.handleClaim(socket, msg.eventId);
+      return;
+    }
+    if (msg.type === "register") {
+      await this.register(
+        socket,
+        msg.teamId,
+        msg.userId,
+        msg.deviceId,
+        msg.deviceLabel,
+        msg.botToken,
+        msg.userToken
+      );
+    }
   }
-  const inFlight = /* @__PURE__ */ new Set();
-  let consecutivePollFailures = 0;
-  while (!opts.signal?.aborted) {
+  async register(socket, teamId, userId, deviceId, deviceLabel, botToken, userToken) {
+    const claimedTeam = teamId.trim();
+    const claimedUser = userId.trim();
+    const claimedDevice = deviceId.trim();
+    const label = (deviceLabel?.trim() || claimedDevice).slice(0, 64);
+    const bot = botToken.trim();
+    const user = userToken.trim();
+    if (!claimedTeam || !claimedUser || !claimedDevice || !bot || !user) {
+      this.send(socket, {
+        type: "error",
+        message: "register needs teamId, userId, deviceId, botToken, and userToken"
+      });
+      return;
+    }
     try {
-      const hadFailures = consecutivePollFailures > 0;
-      const [pending, awaiting, running] = await Promise.all([
-        api.getTasks("pending"),
-        api.getTasks("awaiting_confirmation"),
-        api.getTasks("running")
-      ]);
-      consecutivePollFailures = 0;
-      if (hadFailures) log("poll recovered");
-      const tasks = [...awaiting, ...pending, ...running];
-      for (const task of tasks) {
-        if (inFlight.has(task.id)) continue;
-        if (task.task_status === "running") continue;
-        inFlight.add(task.id);
-        const message = taskMessageText(task);
-        if (message && parseForceStopMessage(message).forceStop) {
-          try {
-            getOrchestrator().stop(ensureCloudCoordinator(opts.agent).id);
-            log(
-              `force-stop interrupt ${task.id.slice(0, 8)} \u2192 coordinator`
-            );
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            log(`force-stop interrupt ${task.id.slice(0, 8)}: ${msg}`);
-          }
-        }
-        void enqueueHandleTask(() => handleTask(api, task, opts)).catch((err) => {
-          const msg = err instanceof Error ? err.message : String(err);
-          log(`error ${task.id.slice(0, 8)}: ${msg}`);
-        }).finally(() => inFlight.delete(task.id));
+      const userAuth = await this.authTest(user);
+      const userTeam = userAuth.team_id?.trim();
+      const userAuthId = userAuth.user_id?.trim();
+      if (!userTeam || !userAuthId) {
+        this.send(socket, {
+          type: "error",
+          message: "user token auth.test did not return team_id/user_id"
+        });
+        return;
+      }
+      if (userTeam !== claimedTeam || userAuthId !== claimedUser) {
+        this.send(socket, {
+          type: "error",
+          message: `User token identity ${userTeam}/${userAuthId} does not match claimed ${claimedTeam}/${claimedUser}`
+        });
+        this.log(
+          `register rejected: claimed ${claimedTeam}/${claimedUser} user-token ${userTeam}/${userAuthId}`
+        );
+        return;
+      }
+      const botAuth = await this.authTest(bot);
+      const botTeam = botAuth.team_id?.trim();
+      if (!botTeam) {
+        this.send(socket, {
+          type: "error",
+          message: "bot token auth.test did not return team_id"
+        });
+        return;
+      }
+      if (botTeam !== claimedTeam) {
+        this.send(socket, {
+          type: "error",
+          message: `Bot token team_id ${botTeam} does not match claimed ${claimedTeam}`
+        });
+        this.log(`register rejected: claimed team ${claimedTeam} bot ${botTeam}`);
+        return;
       }
     } catch (err) {
-      consecutivePollFailures += 1;
-      const msg = err instanceof Error ? err.message : String(err);
-      if (consecutivePollFailures === 1) {
-        log(`poll retry: ${msg}`);
-      } else {
-        log(`poll error: ${msg}`);
+      const errMsg = err instanceof Error ? err.message : String(err);
+      this.send(socket, { type: "error", message: `auth.test failed: ${errMsg}` });
+      return;
+    }
+    const key = slackRelaySessionKey(claimedTeam, claimedUser, claimedDevice);
+    const prev = this.sessions.get(key);
+    if (prev && prev.socket !== socket) {
+      try {
+        prev.socket.close(4e3, "replaced");
+      } catch {
+      }
+      this.bySocket.delete(prev.socket);
+    }
+    const session = {
+      id: `s${++this.seq}`,
+      teamId: claimedTeam,
+      userId: claimedUser,
+      deviceId: claimedDevice,
+      deviceLabel: label,
+      socket,
+      connectedAt: Date.now()
+    };
+    this.sessions.set(key, session);
+    this.bySocket.set(socket, key);
+    this.send(socket, {
+      type: "registered",
+      teamId: claimedTeam,
+      userId: claimedUser,
+      deviceId: claimedDevice
+    });
+    this.log(`desktop registered ${key} (${label})`);
+  }
+  /**
+   * Fan-out an inbound event to matching device(s) for that Slack user.
+   * Optional leading `Personal:` / `Work:` selects by device label.
+   * Desktops must claim; first claim wins.
+   */
+  routeEvent(message) {
+    const userId = message.userId?.trim();
+    if (!userId) {
+      this.log(`skip event ${message.ts}: missing user id`);
+      return false;
+    }
+    const online = this.sessionsForUser(message.teamId, userId);
+    if (online.length === 0) {
+      this.log(`no desktop for ${slackRelayUserKey(message.teamId, userId)} \u2014 skip`);
+      return false;
+    }
+    const { label, rest } = parseSlackDeviceDestination(message.text);
+    let targets = online;
+    let outbound = message;
+    if (label) {
+      const needle = label.toLowerCase();
+      targets = online.filter((s) => s.deviceLabel.toLowerCase() === needle);
+      if (targets.length === 0) {
+        this.log(
+          `no device labeled "${label}" for ${slackRelayUserKey(message.teamId, userId)} \u2014 skip (online: ${online.map((s) => s.deviceLabel).join(", ")})`
+        );
+        return false;
       }
+      outbound = { ...message, text: rest };
     }
-    await new Promise((resolve) => {
-      const t = setTimeout(resolve, pollMs);
-      opts.signal?.addEventListener(
-        "abort",
-        () => {
-          clearTimeout(t);
-          resolve();
-        },
-        { once: true }
-      );
+    const eventId = newSlackRelayEventId();
+    this.pendingClaims.set(eventId, {
+      winnerKey: null,
+      offered: new Set(
+        targets.map((s) => slackRelaySessionKey(s.teamId, s.userId, s.deviceId))
+      )
     });
+    setTimeout(() => this.pendingClaims.delete(eventId), 6e4).unref?.();
+    for (const session of targets) {
+      this.send(session.socket, { type: "event", eventId, message: outbound });
+    }
+    this.log(
+      `fan-out ${eventId} \u2192 ${targets.map((s) => s.deviceLabel || s.deviceId).join(", ")}${label ? ` (dest ${label})` : ""}`
+    );
+    return true;
+  }
+  handleClaim(socket, eventId) {
+    const key = this.bySocket.get(socket);
+    if (!key) {
+      this.send(socket, { type: "error", message: "claim before register" });
+      return;
+    }
+    const pending = this.pendingClaims.get(eventId);
+    if (!pending || !pending.offered.has(key)) {
+      this.send(socket, { type: "claim_denied", eventId });
+      return;
+    }
+    if (!pending.winnerKey) {
+      pending.winnerKey = key;
+      this.send(socket, { type: "claim_ok", eventId });
+      this.log(`claim_ok ${eventId} \u2192 ${key}`);
+      return;
+    }
+    this.send(socket, { type: "claim_denied", eventId });
+  }
+  send(socket, msg) {
+    try {
+      socket.send(JSON.stringify(msg));
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      this.log(`send error: ${errMsg}`);
+    }
+  }
+};
+
+// src/slack/relay-server.ts
+import { createServer as createServer4 } from "http";
+import { WebSocketServer } from "ws";
+async function startSlackRelayServer(opts) {
+  const log = opts.onLog ?? console.log;
+  const appToken = opts.appToken.trim();
+  if (!appToken.startsWith("xapp-")) {
+    throw new Error("SIDEBOARD_SLACK_APP_TOKEN must be an xapp-\u2026 app-level token");
   }
+  const hub = opts.hub ?? new SlackRelayHub({
+    fetchImpl: opts.fetchImpl,
+    onLog: log
+  });
+  const httpServer = createServer4((req, res) => {
+    if (req.url === "/health" || req.url === "/") {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(
+        JSON.stringify({
+          ok: true,
+          service: "sideboard-slack-relay",
+          sessions: hub.listSessions().length
+        })
+      );
+      return;
+    }
+    res.writeHead(404);
+    res.end("Not found");
+  });
+  const wss = new WebSocketServer({ server: httpServer, path: "/desktop" });
+  wss.on("connection", (ws, _req) => {
+    const socket = {
+      send: (data) => {
+        if (ws.readyState === ws.OPEN) ws.send(data);
+      },
+      close: (code, reason) => {
+        try {
+          ws.close(code, reason);
+        } catch {
+        }
+      }
+    };
+    log("desktop connected");
+    ws.on("message", (data) => {
+      const raw = typeof data === "string" ? data : data.toString("utf8");
+      const msg = parseSlackRelayClientMessage(raw);
+      if (!msg) {
+        socket.send(JSON.stringify({ type: "error", message: "invalid message" }));
+        return;
+      }
+      void hub.handleClientMessage(socket, msg);
+    });
+    ws.on("close", () => {
+      hub.detachSocket(socket);
+    });
+    ws.on("error", () => {
+      hub.detachSocket(socket);
+    });
+  });
+  const port = opts.port ?? 0;
+  const host = opts.host ?? "0.0.0.0";
+  await new Promise((resolve, reject) => {
+    httpServer.once("error", reject);
+    httpServer.listen(port, host, () => resolve());
+  });
+  const address = httpServer.address();
+  const boundPort = typeof address === "object" && address ? address.port : typeof port === "number" ? port : 0;
+  const url = `ws://${host === "0.0.0.0" ? "127.0.0.1" : host}:${boundPort}/desktop`;
+  log(`relay listening on ${url}`);
+  const ac = new AbortController();
+  const onAbort = () => ac.abort();
+  opts.signal?.addEventListener("abort", onAbort, { once: true });
+  const socketModeDone = runSlackSocketMode({
+    appToken,
+    signal: ac.signal,
+    fetchImpl: opts.fetchImpl,
+    onLog: (line) => log(line),
+    onEvent: (msg) => {
+      hub.routeEvent(msg);
+    }
+  }).catch((err) => {
+    if (ac.signal.aborted) return;
+    const errMsg = err instanceof Error ? err.message : String(err);
+    log(`socket mode ended: ${errMsg}`);
+  });
+  return {
+    port: boundPort,
+    url,
+    hub,
+    close: async () => {
+      opts.signal?.removeEventListener("abort", onAbort);
+      ac.abort();
+      await new Promise((resolve) => {
+        wss.close(() => resolve());
+      });
+      await new Promise((resolve, reject) => {
+        httpServer.close((err) => err ? reject(err) : resolve());
+      });
+      await socketModeDone.catch(() => void 0);
+    }
+  };
 }
 export {
   ATTACHMENTS_DIR,
+  BAKED_SLACK_RELAY_URL,
   BRIGHTSY_MCP_ALLOWED_TOOLS,
   BrightsySideboardApi,
   CLAUDE_MODEL_CATALOG,
@@ -7643,6 +10118,9 @@ export {
   LEGACY_ATTACHMENTS_DIR,
   LEGACY_PLAN_FILE_REL,
   LEGACY_REVIEW_REQUEST_PATH,
+  LINEAR_OAUTH_PORT,
+  LINEAR_OAUTH_REDIRECT,
+  LINEAR_OAUTH_SCOPES,
   MAX_ANTHROPIC_CACHE_CONTROL_BLOCKS,
   ORCHESTRATOR_AGENT_KINDS,
   Orchestrator,
@@ -7659,7 +10137,16 @@ export {
   SIDEBOARD_FORCE_STOP,
   SIDEBOARD_MCP_ALLOWED_TOOLS,
   SIDEBOARD_MCP_PROFILE_ENV,
+  SLACK_LISTEN_BUSY_REPLY,
+  SLACK_LISTEN_STOPPED_REPLY,
+  SLACK_LISTEN_TIMEOUT_REPLY,
+  SLACK_OAUTH_PORT,
+  SLACK_OAUTH_REDIRECT,
+  SLACK_REPLY_FORMATTING,
+  SLACK_SEEN_REACTION,
+  SlackRelayHub,
   THINKING_EFFORTS,
+  ackSlackInboundSeen,
   addPrStackLayer,
   addStackLayerFromThread,
   addWorkspace,
@@ -7701,8 +10188,10 @@ export {
   buildReviewRequestAttachment,
   buildSessionSeed,
   buildWorkspaceScriptEnv,
+  caffeinateHoldPath,
   caffeinateWhileCloudConnectEnabled,
   caffeinateWhileRunningEnabled,
+  caffeinateWhileSlackListenEnabled,
   captureLoginEnv,
   captureTurnBaseline,
   checkoutPrStackLayer,
@@ -7720,6 +10209,7 @@ export {
   conductorDbPath,
   confirmLand,
   connectBrightsyTeam,
+  connectSlackToken,
   coordinatorSystemPrompt,
   coordinatorTurnReminder,
   copyConfiguredFiles,
@@ -7728,6 +10218,7 @@ export {
   createEmptyThread,
   createExistingBranchWorktree,
   createGlobalChat,
+  createLinearPkce,
   createOrUpdatePr,
   createPrStack,
   createThread,
@@ -7742,7 +10233,11 @@ export {
   detectGhStack,
   detectLocalMergeConflicts,
   disconnectBrightsyTeam,
+  disconnectLinear,
+  disconnectLinearConnection,
+  disconnectSlackWorkspace,
   discoverSkills,
+  dismissSlackReplyBadge,
   dropCachedPrefixOnResume,
   encodeBrightsyTarget,
   enrichPathWithNpmGlobalBin,
@@ -7752,6 +10247,8 @@ export {
   ensureGhPreferOrigin,
   ensureGlobalCoordinatorCwd,
   ensureReviewRequestFile,
+  ensureSlackCoordinator,
+  ensureSlackDeviceIdentity,
   ensureWorkspace,
   estimateMessageChars,
   estimateThreadChars,
@@ -7780,6 +10277,8 @@ export {
   formatPlanQuestionsForChat,
   formatRateLimitResetHint,
   formatRenameBranchDirective,
+  formatSlackInboundPrompt,
+  formatSlackSignedReply,
   formatTranscriptMarkdown,
   formatWorkspaceInventory,
   formatWorktreeDirective,
@@ -7787,6 +10286,7 @@ export {
   getAdapter,
   getAgentSetupInfo,
   getBrightsySession,
+  getCaffeinateHold,
   getDefaultAgent,
   getDefaultEffort,
   getDefaultFast,
@@ -7797,6 +10297,7 @@ export {
   getGitHubStatus,
   getIssueSource,
   getLinearApiKey,
+  getLinearAuthToken,
   getOrchestrator,
   getPr,
   getPrChecks,
@@ -7806,12 +10307,16 @@ export {
   getRepoSetupInfo,
   getRunMode,
   getRunScript,
+  getSlackWorkspace,
   gh,
   ghHeadRef,
   ghRepoSelectArgs,
   git,
   globalAgentCwd,
+  handleSlackInbound,
   harnessEnvKey,
+  hasBakedLinearOAuth,
+  hasBakedSlackOAuth,
   hasConductorHook,
   hasCursorWorktreeSetup,
   hasRepoHook,
@@ -7836,6 +10341,7 @@ export {
   isGlobalThread,
   isImageFilePath,
   isInPrStack,
+  isInboundForThisDesktop,
   isLinearConnected,
   isOrchestratorCapableAgent,
   isOrchestratorThread,
@@ -7844,8 +10350,12 @@ export {
   isPresentPlanToolName,
   isSessionQuotaLimit,
   isSideboardScratchPath,
+  isSlackCoordinatorThread,
   isThinkingEffort,
   isWorkspaceScratchPath,
+  linearAuthorizationHeader,
+  linearOAuthAuthorizeUrl,
+  linearOAuthCredentials,
   listAgentSetupInfo,
   listBranchCommits,
   listBranches,
@@ -7864,6 +10374,8 @@ export {
   listOpencodeModels,
   listPrs,
   listRunScripts,
+  listSlackReplyBadges,
+  listSlackWorkspaces,
   listThreads,
   listWorkspaces,
   listWorktreeFiles,
@@ -7907,9 +10419,13 @@ export {
   parseMcpList,
   parsePlanQuestionsInput,
   parseSessionQuotaResetAt,
+  parseSlackRelayClientMessage,
+  parseSlackRelayServerMessage,
   partsToAssistantText,
   pastedTextStats,
+  permalinkForSlackReplyBadge,
   permissionMode,
+  persistVaultKeyInKeychain,
   planFileAbs,
   posixShellSingleQuote,
   prepareTerminalCommand,
@@ -7917,13 +10433,16 @@ export {
   promptMentionsBrightsy,
   pushBranch,
   readExistingReviewRequestFile,
+  readKeychainVaultKey,
   readPlanFile,
   readSkillBody,
   readThread,
   readWorktreeFile,
   readWorktreeFileForUpload,
   readWorktreeInclude,
+  recordSlackOutboundWatch,
   refreshGitHubAuth,
+  refreshSlackReplyBadges,
   removeWorkspace,
   removeWorktree,
   repoSlug,
@@ -7948,18 +10467,26 @@ export {
   resolveQuotaFallbackAgent,
   resolveRepoRoot,
   resolveReviewGuidelines,
+  resolveSlackListenMode,
   resolveThreadDefaults,
   resolveThreadEffort,
+  resolveVaultKey,
   resolveWorktreeStartPoint,
   run,
   runArchiveScript,
   runCloudConnect,
   runCursorWorktreeSetup,
   runSetupScript,
+  runSlackListen,
+  runSlackRelayClient,
   sameWorktreePath,
   sanitizeMcpServerName,
   saveAppSettings,
+  saveLinearOAuth,
+  secureFileUnlocksWith,
+  setCaffeinateHold,
   setStatus,
+  setVaultMasterKey,
   settingsSourceLabel,
   shouldAttachPastedText,
   shouldCompactContext,
@@ -7970,6 +10497,12 @@ export {
   sideboardMcpProfile,
   sideboardReposDir,
   sideboardWorkspacesDir,
+  slackAppLevelToken,
+  slackArchiveUrl,
+  slackCoordinatorSourceRef,
+  slackListenEnabled,
+  slackOAuthCredentials,
+  slackRelayUrl,
   slugify,
   spawnAgentTurn,
   splitForCompaction,
@@ -7979,8 +10512,11 @@ export {
   stageAbsolutePathsAsAttachments,
   stageBuffersAsAttachments,
   startDevServer,
+  startLinearOAuth,
   startMcpServer,
   startOrchestration,
+  startSlackOAuth,
+  startSlackRelayServer,
   stripBrightsyNdjsonNoise,
   submitPrStack,
   suggestSlug,
@@ -7998,6 +10534,7 @@ export {
   threadRequestsBrightsyMcp,
   threadsDir,
   threadsSharingWorktree,
+  toPublicAppSettings,
   toolDescription,
   toolDetail,
   toolFilePath,